Commit 24e860f6d3 for ffmpeg

commit 24e860f6d3c4f2ebae65ed7649e2a8860d512879
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 8 01:53:31 2026 +0200

    avformat/mpegtsenc: Check the size of Opus packets before adding the control header

    Not a security issue.

    Fixes: signed integer overflow
    Fixes: aPjAIXKxDfoa
    Signed integer overflow Replicated through API with UBSAN
    Found during triage of the security report GL61hVKFlOuU

diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
index 8b5b4a922a..89d64c1f1c 100644
--- a/libavformat/mpegtsenc.c
+++ b/libavformat/mpegtsenc.c
@@ -2145,6 +2145,8 @@ static int mpegts_write_packet_internal(AVFormatContext *s, AVPacket *pkt)
                 trim_end = AV_RL32(side_data + 4) * 48000 / st->codecpar->sample_rate;
             }

+            if (pkt->size > INT_MAX - 7 - pkt->size / 255)
+                return AVERROR(ENOMEM);
             ctrl_header_size = pkt->size + 2 + pkt->size / 255 + 1;
             if (ts_st->opus_pending_trim_start)
               ctrl_header_size += 2;