Commit c64a6bdbf0 for ffmpeg

commit c64a6bdbf009d53ef09fbc634aff77348e22e32b
Author: Kacper Michajłow <kasper93@gmail.com>
Date:   Thu Oct 15 17:24:32 2026 +0200

    avformat/dashdec: bound the root URL copy by the size of tmp_str

    Allocate tmp_str with room for the slash appended to the root URL and
    the terminating null, like path, and bound the copy of the root URL and
    the BaseURL concatenation by that size instead of by the length of the
    root URL.

    Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 90a5897b38..f7fb7fec8c 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -770,7 +770,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
     av_free(text);

     path = av_mallocz(tmp_max_url_size + 2);
-    tmp_str = av_mallocz(tmp_max_url_size);
+    tmp_str = av_mallocz(tmp_max_url_size + 2);
     if (!tmp_str || !path) {
         updated = AVERROR(ENOMEM);
         goto end;
@@ -817,7 +817,6 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur

     if (size > 0 && root_url[size - 1] != token) {
         av_strlcat(root_url, "/", size + 2);
-        size += 2;
     }

     for (i = 0; i < n_baseurl_nodes; ++i) {
@@ -828,7 +827,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
         if (text && !av_strstart(text, "/", NULL)) {
             memset(tmp_str, 0, strlen(tmp_str));
             if (!ishttp(text) && isRootHttp) {
-                av_strlcpy(tmp_str, root_url, size + 1);
+                av_strlcpy(tmp_str, root_url, tmp_max_url_size + 2);
             }
             start = (text[0] == token);
             if (start && av_stristr(tmp_str, text)) {
@@ -841,7 +840,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
                 p = strchr(p, '/');
                 memset(p + 1, 0, strlen(p));
             }
-            av_strlcat(tmp_str, text + start, tmp_max_url_size);
+            av_strlcat(tmp_str, text + start, tmp_max_url_size + 2);
             xmlFree(text);
             xmlChar* escaped = xmlEncodeSpecialChars(NULL, tmp_str);
             if (!escaped) {