Commit ee457fdcdb for ffmpeg

commit ee457fdcdb3a069ef35910a2e1cacff10906b131
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Oct 18 05:34:56 2026 +0200

    avcodec/cbs_jpeg: count byte stuffing only in the entropy-coded part of a scan

    Fixes: 28PPo4pFl31u
    Fixes: AISLE-2026-0150-00699
    Fixes: assertion failure
    Assertion failure Replicated through UnModified FFmpeg with an ASAN build

    Found-by: Joshua Rogers (AISLE)

    The report suggested counting 0xff bytes only after the scan header.

diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c
index d64e2baec0..e1631a4246 100644
--- a/libavcodec/cbs_jpeg.c
+++ b/libavcodec/cbs_jpeg.c
@@ -362,7 +362,7 @@ static int cbs_jpeg_assemble_fragment(CodedBitstreamContext *ctx,
         unit = &frag->units[i];
         size += 2 + unit->data_size;
         if (unit->type == JPEG_MARKER_SOS) {
-            for (sp = 0; sp < unit->data_size; sp++) {
+            for (sp = AV_RB16(unit->data); sp < unit->data_size; sp++) {
                 if (unit->data[sp] == 0xff)
                     ++size;
             }