File ffmpeg-8-CVE-2026-75147.patch of Package A_tw-ffmpeg-8

From 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Tue, 4 Aug 2026 12:11:55 +0000
Subject: [PATCH] avformat/rtpenc_av1: bound OBU size in the keyframe search
 loop

The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by
num_lebs + obu_size without bounding obu_size against the remaining data
(unlike the main packetization loop). A crafted obu_size (~0x80000010)
wraps the signed rem_size back positive, so the next iteration
dereferences a pointer past the packet. Consume the LEB bytes first, then
reject an OBU larger than the remaining size. Out-of-bounds read reachable
from a crafted AV1 packet muxed to RTP.

Fixes: out of array read
---
 libavformat/rtpenc_av1.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c
index fbf9212216..ae66fdb86f 100644
--- a/libavformat/rtpenc_av1.c
+++ b/libavformat/rtpenc_av1.c
@@ -116,8 +116,15 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t *frame_buf, int frame_s
             if (!num_lebs) {
                 break;
             }
-            buf_ptr += num_lebs + obu_size;
-            rem_size -= num_lebs + obu_size;
+            buf_ptr += num_lebs;
+            rem_size -= num_lebs;
+            // bound OBU payload against remaining data to avoid pointer/size
+            // wraparound (mirrors the check in the packetization loop below)
+            if (obu_size > (uint32_t) rem_size) {
+                break;
+            }
+            buf_ptr += obu_size;
+            rem_size -= obu_size;
         }
 #else // RTPENC_AV1_SEARCH_SEQ_HEADER
         av_log(ctx, AV_LOG_DEBUG, "Marking FIRST packet\n");
-- 
2.49.0