File ffmpeg-8-CVE-2026-75145.patch of Package A_tw-ffmpeg-8

From b4c199c5906ff53368926c2a5839881f41957e7f Mon Sep 17 00:00:00 2001
From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Tue, 4 Aug 2026 12:11:55 +0000
Subject: [PATCH] avformat/rtpenc_av1: do not narrow the OBU size to (long)

(long)obu_size sign-flips values in 0x80000000..0xfffffffd on ILP32/LLP64
targets (32-bit long, e.g. 64-bit Windows), bypassing the size check.
Compare as uint32_t; frame_size is non-negative at this point.

No PoC as the used setup was 64bit specific
---
 libavformat/rtpenc_av1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c
index 934cfb63a3..f7c6aad47a 100644
--- a/libavformat/rtpenc_av1.c
+++ b/libavformat/rtpenc_av1.c
@@ -177,7 +177,7 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t *frame_buf, int frame_s
             return;
         }
 
-        if ((long) obu_size > frame_size) {
+        if (obu_size > (unsigned) frame_size) {
             av_log(ctx, AV_LOG_ERROR, "AV1 OBU size %d larger than remaining frame size %d\n", obu_size, frame_size);
             return;
         }
-- 
2.49.0