Commit b89ce54d93 for ffmpeg

commit b89ce54d93bf644433dfa9fbc34f19c22237691a
Author: Joshua Rogers <joshua.rogers@aisle.com>
Date:   Sun Oct 18 05:37:11 2026 +0200

    avcodec/cbs_jpeg: check the scan data size without overflowing size_t

    Fixes: xf78sw1plZNy
    Fixes: AISLE-2026-0150-00556
    Fixes: out of array write
    Out of array write Replicated through UnModified FFmpeg with ASAN

    Found-by: Joshua Rogers (AISLE)

    The check is the one given in the report's recommendation; analysis,
    testcase and verification by Michael Niedermayer.

diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c
index e1631a4246..577757dbea 100644
--- a/libavcodec/cbs_jpeg.c
+++ b/libavcodec/cbs_jpeg.c
@@ -296,7 +296,7 @@ static int cbs_jpeg_write_scan(CodedBitstreamContext *ctx,
         return err;

     if (scan->data) {
-        if (scan->data_size * 8 > put_bits_left(pbc))
+        if (scan->data_size > put_bits_left(pbc) / 8)
             return AVERROR(ENOSPC);

         av_assert0(put_bits_count(pbc) % 8 == 0);