Commit 91fcca692f for ffmpeg

commit 91fcca692fc96a8213b341de88d05a7c0866152c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Sep 24 00:16:33 2026 +0200

    avformat/rtpenc_jpeg: check that a marker segment lies within the frame

    Fixes: read into padding
    Fixes: 1SLVIPZzDH7n
    Found-by: zhang xingxing
    Suggested-by: zhang xingxing
    Replicated through Modified FFmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c
index e4e95931f4..ddbce261d4 100644
--- a/libavformat/rtpenc_jpeg.c
+++ b/libavformat/rtpenc_jpeg.c
@@ -50,6 +50,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
         if (buf[i] != 0xff)
             continue;

+        if (size - i < 5 || (buf[i + 1] == SOF0 && size - i < 18)) {
+            av_log(s1, AV_LOG_ERROR, "Too short JPEG header. Aborted!\n");
+            return;
+        }
+
         if (buf[i + 1] == DQT) {
             int tables, j;
             if (buf[i + 4] & 0xF0)