Commit 0b007e0634 for ffmpeg

commit 0b007e0634de5b4424b9993c95a6c1c50de0115b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 30 19:05:53 2026 +0100

    avcodec/mpegaudiodec: fail on packets too large for the bit reader

    Fixes: NULL pointer dereference
    Fixes: signed integer overflow
    Fixes: LV4ZEjFMTZt7
    Fixes: AISLE-2026-0150-00644
    NULL pointer dereference Replicated through API with ASAN and UBSAN

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/mpegaudiodec_template.c b/libavcodec/mpegaudiodec_template.c
index 2ac7be3b80..b146307dd9 100644
--- a/libavcodec/mpegaudiodec_template.c
+++ b/libavcodec/mpegaudiodec_template.c
@@ -1475,7 +1475,9 @@ static int mp_decode_frame(MPADecodeContext *s, OUT_INT **samples,
     int i, nb_frames, ch, ret;
     OUT_INT *samples_ptr;

-    init_get_bits(&s->gb, buf + HEADER_SIZE, (buf_size - HEADER_SIZE) * 8);
+    ret = init_get_bits8(&s->gb, buf + HEADER_SIZE, buf_size - HEADER_SIZE);
+    if (ret < 0)
+        return ret;
     if (s->hdr.error_protection)
         s->crc = get_bits(&s->gb, 16);