Commit cb6e9efa88 for ffmpeg

commit cb6e9efa887f68967b88144b8d26f0dd3e043081
Author: Jun Zhao <barryjzhao@tencent.com>
Date:   Fri Oct 23 21:16:41 2026 +0800

    avformat/id3v2: skip unread bytes after chapter text subframes

    read_ttag() stops at the first NUL terminator or on decoding errors
    without consuming the remainder of the declared frame payload. Subtracting
    tlen in read_chapter() without advancing pb over the unread bytes leaves
    the stream misaligned for any subsequent embedded subframe.

    Track the number of bytes consumed by read_ttag() and skip the remainder
    of tlen before reading the next subframe header.

    Signed-off-by: Jun Zhao <barryjzhao@tencent.com>

diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
index 59493033db..22a15ab794 100644
--- a/libavformat/id3v2.c
+++ b/libavformat/id3v2.c
@@ -739,6 +739,7 @@ static void read_chapter(AVFormatContext *s, AVIOContext *pb, int len,
     len -= 16;
     while (len > 10) {
         unsigned tlen;
+        int64_t start, consumed;

         if (avio_read(pb, tag, 4) < 4)
             break;
@@ -757,10 +758,13 @@ static void read_chapter(AVFormatContext *s, AVIOContext *pb, int len,
                    tag, tlen);
             break;
         }
+        start = avio_tell(pb);
         if (tag[0] == 'T')
             read_ttag(s, pb, tlen, &chap->meta, tag);
-        else
-            avio_skip(pb, tlen);
+        consumed = avio_tell(pb) - start;
+        if (consumed < 0 || consumed > tlen ||
+            avio_skip(pb, tlen - consumed) < 0)
+            break;
         len -= tlen;
     }