Commit 5c0b32e0ae for ffmpeg

commit 5c0b32e0ae5134864e0cbd4236d17e91fa10c445
Author: zhang xingxing <2388969553@qq.com>
Date:   Thu Oct 15 04:35:44 2026 +0200

    avcodec/tiff_common: do not size the metadata bprint from count

    Fixes: 0gCI9NJKm3tO
    Fixes: swarm-Signed-overflow-of-10-count-100-count-in-av_bprint_init-f6bdbe
    Regression since: b7ba7cbd6e
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Found-by: zhang xingxing <2388969553@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/tiff_common.c b/libavcodec/tiff_common.c
index 265f843031..c4c672632a 100644
--- a/libavcodec/tiff_common.c
+++ b/libavcodec/tiff_common.c
@@ -108,7 +108,7 @@ int ff_tadd_doubles_metadata(int count, const char *name, const char *sep,
     if (bytestream2_get_bytes_left(gb) < count * sizeof(int64_t))
         return AVERROR_INVALIDDATA;

-    av_bprint_init(&bp, 10 * count, 100 * count);
+    av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED);

     for (i = 0; i < count; i++) {
         av_bprintf(&bp, "%s%.15g", auto_sep(count, sep, i, 4), ff_tget_double(gb, le));
@@ -129,7 +129,7 @@ int ff_tadd_shorts_metadata(int count, const char *name, const char *sep,
     if (bytestream2_get_bytes_left(gb) < count * sizeof(int16_t))
         return AVERROR_INVALIDDATA;

-    av_bprint_init(&bp, 10 * count, AV_BPRINT_SIZE_UNLIMITED);
+    av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED);

     for (i = 0; i < count; i++) {
         int v = is_signed ? (int16_t)ff_tget_short(gb, le) :  ff_tget_short(gb, le);