Commit 5993347a1b for ffmpeg

commit 5993347a1b84a88892ac66a8ef981f7f18e9997c
Author: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Date:   Sun Oct 18 17:24:07 2026 +0800

    avformat/flvenc: reject text packets too long for an AMF0 string

    AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a
    16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for
    70000 bytes) while the whole text was written, so readers misparse the
    onTextData tag.

    Fail on such packets before writing the tag.
    Found while reviewing the metadata length fix for FLV.

    Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>

diff --git a/libavformat/flvenc.c b/libavformat/flvenc.c
index 7c8d0a126b..2febb96d05 100644
--- a/libavformat/flvenc.c
+++ b/libavformat/flvenc.c
@@ -1280,6 +1280,12 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt)
             return AVERROR(EINVAL);
         }
     }
+    /* the text is written as an AMF0 string with a 16-bit length */
+    if (par->codec_id == AV_CODEC_ID_TEXT &&
+        strlen((const char *)pkt->data) > UINT16_MAX) {
+        av_log(s, AV_LOG_ERROR, "Text packet is too long for FLV\n");
+        return AVERROR(EINVAL);
+    }

     ts = pkt->dts;