Commit 11c22178bb for ffmpeg

commit 11c22178bb7ae7dd54e5bf3a95ff9848f8562c40
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 02:15:27 2026 +0200

    avformat/rtpenc: Reject packet sizes too small for the AV1 payload headers

    Fixes: heap-buffer-overflow
    Fixes: FyS11JI5UXC7
    Fixes: ffmpeg -i fate-suite/av1/film_grain.ivf -frames:v 2 -c copy -strict experimental -f rtp -packetsize 13 /dev/null

    Out of array read Replicated through UnModified FFmpeg with ASAN

    Found during triage of the security report TwYfznAFyatl (#22717)

diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index d2a8646a95..b3a5b0ff35 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -280,6 +280,7 @@ static int rtp_write_header(AVFormatContext *s1)
             ret = AVERROR_EXPERIMENTAL;
             goto fail;
         }
+        payload_header_size = 3;
         break;
     case AV_CODEC_ID_VORBIS:
     case AV_CODEC_ID_THEORA: