Commit e48278ec3b for ffmpeg

commit e48278ec3b518326c2b9c5051cccfee06dd5d4ed
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 00:04:51 2026 +0200

    avformat/rtmppkt: Write the full basic header for continuation chunks

    Continuation chunks were marked with the single byte 0xC0 | channel_id,
    which is only valid for chunk stream ids below 64. Ids from 64 need the
    2 or 3 byte form of the basic header, as used for the first chunk, so
    the peer misparsed the rest of the stream. Repeat the basic header of
    the first chunk with chunk type 3.

    Corrupt chunk stream Replicated through UnModified FFmpeg
    Found during triage of the security report BvkwW4Yd19HN

diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c
index 98fb98a9bc..209ecd3257 100644
--- a/libavformat/rtmppkt.c
+++ b/libavformat/rtmppkt.c
@@ -315,6 +315,7 @@ int ff_rtmp_packet_write(URLContext *h, RTMPPacket *pkt,
                          int *nb_prev_pkt)
 {
     uint8_t pkt_hdr[18], *p = pkt_hdr;
+    int basic_hdr_size;
     int mode = RTMP_PS_TWELVEBYTES;
     int off = 0;
     int written = 0;
@@ -363,6 +364,7 @@ int ff_rtmp_packet_write(URLContext *h, RTMPPacket *pkt,
         bytestream_put_byte(&p, 1               | (mode << 6));
         bytestream_put_le16(&p, pkt->channel_id - 64);
     }
+    basic_hdr_size = p - pkt_hdr;
     if (mode != RTMP_PS_ONEBYTE) {
         bytestream_put_be24(&p, pkt->ts_field);
         if (mode != RTMP_PS_FOURBYTES) {
@@ -391,16 +393,16 @@ int ff_rtmp_packet_write(URLContext *h, RTMPPacket *pkt,
     if ((ret = ffurl_write(h, pkt_hdr, p - pkt_hdr)) < 0)
         return ret;
     written = p - pkt_hdr + pkt->size;
+    pkt_hdr[0] |= RTMP_PS_ONEBYTE << 6;
     while (off < pkt->size) {
         int towrite = FFMIN(chunk_size, pkt->size - off);
         if ((ret = ffurl_write(h, pkt->data + off, towrite)) < 0)
             return ret;
         off += towrite;
         if (off < pkt->size) {
-            uint8_t marker = 0xC0 | pkt->channel_id;
-            if ((ret = ffurl_write(h, &marker, 1)) < 0)
+            if ((ret = ffurl_write(h, pkt_hdr, basic_hdr_size)) < 0)
                 return ret;
-            written++;
+            written += basic_hdr_size;
             if (pkt->ts_field == 0xFFFFFF) {
                 uint8_t ts_header[4];
                 AV_WB32(ts_header, timestamp);