Commit 9df5d7703d for ffmpeg

commit 9df5d7703d78244a6e25fbccf4c8b252cbd06d88
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Sep 24 00:47:48 2026 +0200

    avformat/webpenc: reject a VP8X chunk that extends past the packet

    Fixes: out of array read
    Fixes: twp2aA6PnymU
    Found-by: Mohamed K. Fathy <sirmatrixpage@gmail.com>

diff --git a/libavformat/webpenc.c b/libavformat/webpenc.c
index 5d0eed5a8e..88e35a315b 100644
--- a/libavformat/webpenc.c
+++ b/libavformat/webpenc.c
@@ -88,9 +88,12 @@ static int flush(AVFormatContext *s, int trailer, int64_t pts)
         skip = 12;

     if (AV_RL32(w->last_pkt->data + skip) == AV_RL32("VP8X")) {
+        int64_t vp8x_end = skip + 8 + (int64_t)AV_RL32(w->last_pkt->data + skip + 4);
+        if (vp8x_end > w->last_pkt->size)
+            return AVERROR_INVALIDDATA;
         flags |= w->last_pkt->data[skip + 4 + 4];
         vp8x = 1;
-        skip += AV_RL32(w->last_pkt->data + skip + 4) + 8;
+        skip = vp8x_end;
     }

     if (!w->wrote_webp_header) {