Commit bc896c613e for ffmpeg

commit bc896c613ec0d4ad0108d62fbdda0196f69e7121
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 00:00:07 2026 +0100

    avcodec/jpegxl_parser: stop before a TOC that cannot fit in the input

    Fixes: QbQGn4p3g48Q
    Fixes: AISLE-2026-0150-00842
    Fixes: Timeout
    Timeout Replicated through UnModified FFmpeg with /usr/bin/time

    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 902a1532aa..5b64347726 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1317,6 +1317,10 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
     else
         toc_count = 2 + num_lf_groups + num_groups * num_passes;

+    /* each TOC entry takes at least 12 bits */
+    if ((int64_t)toc_count * 12 > get_bits_left(gb))
+        return AVERROR_BUFFER_TOO_SMALL;
+
     // permuted toc
     if (get_bits1(gb)) {
         JXLEntropyDecoder dec;