Commit ea01b058e3 for ffmpeg

commit ea01b058e3cd9a2012f2b1a36efee499e9dfe32b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 16:32:49 2026 +0100

    avformat/imfdec: fix the overflow check of the resource count

    Fixes: out of array write
    Fixes: spGhOOxgliHp
    Regression since: ef0d5245d6

    Found during the triage of a finding from the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25795

    Out of array write Replicated through UnModified FFmpeg with ASAN

diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
index 39a95366e6..2aebdc3b8b 100644
--- a/libavformat/imfdec.c
+++ b/libavformat/imfdec.c
@@ -482,9 +482,8 @@ static int open_track_file_resource(AVFormatContext *s,
            AV_UUID_ARG(asset_locator->uuid),
            asset_locator->absolute_uri);

-    if (track->resource_count > INT32_MAX - track_file_resource->base.repeat_count
-        || (track->resource_count + track_file_resource->base.repeat_count)
-            > INT_MAX / sizeof(IMFVirtualTrackResourcePlaybackCtx))
+    if (track_file_resource->base.repeat_count
+            > INT_MAX / sizeof(IMFVirtualTrackResourcePlaybackCtx) - track->resource_count)
         return AVERROR(ENOMEM);
     tmp = av_fast_realloc(track->resources,
                           &track->resources_alloc_sz,