Commit 59af4fea04 for ffmpeg

commit 59af4fea04e04f8a936293aa87a544187281b39b
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 02:15:12 2026 +0200

    avformat/rtpenc: Reject packet sizes too small for the H.263 payload header

    Fixes: negative-size-param
    Fixes: infinite loop
    Fixes: gFLqHoPMr8J5
    Fixes: ffmpeg -f lavfi -i testsrc=duration=0.2:size=176x144:rate=5 -c:v h263 -f rtp -packetsize 13 /dev/null
    Fixes: ffmpeg -f lavfi -i testsrc=duration=0.2:size=176x144:rate=5 -c:v h263 -rtpflags rfc2190 -f rtp -packetsize 13 /dev/null

    Negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN

    Found during triage of the security report TwYfznAFyatl (#22717)

diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index dff76aab44..26f89cd7af 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -205,6 +205,15 @@ static int rtp_write_header(AVFormatContext *s1)
             goto fail;
         }
         break;
+    case AV_CODEC_ID_H263:
+        if (s->flags & FF_RTP_FLAG_RFC2190) {
+            payload_header_size = 8;
+            break;
+        }
+        av_fallthrough;
+    case AV_CODEC_ID_H263P:
+        payload_header_size = 2;
+        break;
     case AV_CODEC_ID_H261:
         if (s1->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) {
             av_log(s, AV_LOG_ERROR,