Commit ebf7955a63 for ffmpeg

commit ebf7955a638ec6a98ff23a2deaa589b87a089dc3
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 18:54:19 2026 +0100

    avcodec/cbs_h2645: compute the size of the assembled fragment in 64 bits

    With a 32 bit size_t the sum of the unit sizes with the worst case
    emulation prevention overhead could wrap.

    This is not a security issue: the units are written from one packet of
    at most INT_MAX bytes, 3/2 of that fits in 32 bits, and the more than
    2^28 units needed to wrap the sum do not fit in a 32 bit address space.

    Found-by: Anthony Hurtado
    Ticket: frJt2MGMT7O1

diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 9329554cab..653e4117a2 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -324,7 +324,8 @@ int ff_cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
                                        CodedBitstreamFragment *frag)
 {
     uint8_t *data;
-    size_t max_size, dp, sp;
+    uint64_t max_size;
+    size_t dp, sp;
     int err, i, zero_run;

     for (i = 0; i < frag->nb_units; i++) {
@@ -335,8 +336,10 @@ int ff_cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
     max_size = 0;
     for (i = 0; i < frag->nb_units; i++) {
         // Start code + content with worst-case emulation prevention.
-        max_size += 4 + frag->units[i].data_size * 3 / 2;
+        max_size += 4 + frag->units[i].data_size * UINT64_C(3) / 2;
     }
+    if (max_size > SIZE_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
+        return AVERROR(ENOMEM);

     data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!data)