Commit 5d59b7c45d for ffmpeg

commit 5d59b7c45d7142bddd13ddc8891e72c5c7dc991b
Author: zhang xingxing <2388969553@qq.com>
Date:   Tue Oct 13 06:52:48 2026 +0200

    avcodec/mpc7: reject a last frame length larger than a frame

    Fixes: out of array read
    Fixes: dcrkQkffMQ8b
    Fixes: swarm-Missing-bounds-check-on-last-frame-length-enables-heap-OOB-read-e00668

    Found-by: zhang xingxing <2388969553@qq.com>

    Out of array read Replicated through UnModified FFmpeg with ASAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/mpc7.c b/libavcodec/mpc7.c
index b95cec1f0f..1824c7e98b 100644
--- a/libavcodec/mpc7.c
+++ b/libavcodec/mpc7.c
@@ -109,6 +109,10 @@ static av_cold int mpc7_decode_init(AVCodecContext * avctx)
     skip_bits_long(&gb, 88);
     c->gapless = get_bits1(&gb);
     c->lastframelen = get_bits(&gb, 11);
+    if (c->lastframelen > MPC_FRAME_SIZE) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid last frame length: %d\n", c->lastframelen);
+        return AVERROR_INVALIDDATA;
+    }
     av_log(avctx, AV_LOG_DEBUG, "IS: %d, MSS: %d, TG: %d, LFL: %d, bands: %d\n",
             c->IS, c->MSS, c->gapless, c->lastframelen, c->maxbands);
     c->frames_to_skip = 0;