Commit b65f572aeb for ffmpeg

commit b65f572aebeac1e722590ab5451285403c297839
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 23:26:40 2026 +0200

    avformat/rtpdec_asf: Reject ASF packet lengths beyond the RTP payload

    The check is the one recommended in the report.

    Fixes: use of uninitialized memory
    Fixes: 9sWoEae5AABB
    Fixes: AISLE-2026-0111-00026
    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
index f7fa69e27f..1360a39191 100644
--- a/libavformat/rtpdec_asf.c
+++ b/libavformat/rtpdec_asf.c
@@ -264,12 +264,11 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
                 int cur_len = start_off + len_off - off;
                 int prev_len = out_len;
                 out_len += cur_len;
-                if (FFMIN(cur_len, len - off) < 0)
+                if (cur_len < 0 || cur_len > len - off)
                     return -1;
                 if ((res = av_reallocp(&asf->buf, out_len)) < 0)
                     return res;
-                memcpy(asf->buf + prev_len, buf + off,
-                       FFMIN(cur_len, len - off));
+                memcpy(asf->buf + prev_len, buf + off, cur_len);
                 avio_skip(pb, cur_len);
             }
         }