Commit a3d8c8b4d0 for ffmpeg

commit a3d8c8b4d010574874e0d89cab91e6fa0c52e413
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 02:00:49 2026 +0100

    avformat/imfdec: compute the resource end time without overflow

    Fixes: signed integer overflow
    Fixes: x8FdiC5jwHwL

    Found-by: zhang xingxing <2388969553@qq.com>

    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
index 84b7a4d6e3..39a95366e6 100644
--- a/libavformat/imfdec.c
+++ b/libavformat/imfdec.c
@@ -466,6 +466,7 @@ static int open_track_file_resource(AVFormatContext *s,
 {
     IMFContext *c = s->priv_data;
     IMFAssetLocator *asset_locator;
+    AVRational duration;
     void *tmp;

     asset_locator = find_asset_map_locator(&c->asset_locator_map, track_file_resource->track_file_uuid);
@@ -493,6 +494,10 @@ static int open_track_file_resource(AVFormatContext *s,
         return AVERROR(ENOMEM);
     track->resources = tmp;

+    av_reduce(&duration.num, &duration.den,
+              track_file_resource->base.duration * (int64_t)track_file_resource->base.edit_rate.den,
+              track_file_resource->base.edit_rate.num, INT_MAX);
+
     for (uint32_t i = 0; i < track_file_resource->base.repeat_count; i++) {
         IMFVirtualTrackResourcePlaybackCtx vt_ctx;

@@ -503,10 +508,7 @@ static int open_track_file_resource(AVFormatContext *s,
         vt_ctx.ts_offset = av_sub_q(vt_ctx.start_time,
                                     av_div_q(av_make_q((int)track_file_resource->base.entry_point, 1),
                                              track_file_resource->base.edit_rate));
-        vt_ctx.end_time = av_add_q(track->duration,
-                                   av_make_q((int)track_file_resource->base.duration
-                                                 * track_file_resource->base.edit_rate.den,
-                                             track_file_resource->base.edit_rate.num));
+        vt_ctx.end_time = av_add_q(track->duration, duration);
         track->resources[track->resource_count++] = vt_ctx;
         track->duration = vt_ctx.end_time;
     }