Commit 7b6e2f3a2a for ffmpeg

commit 7b6e2f3a2a03e72e1f5a4e9845f8081dd9fc1f52
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 23:17:37 2026 +0200

    fftools/ffmpeg_mux: Avoid signed overflow in the invalid DTS fix-up

    Fixes: signed integer overflow
    Fixes: YK9ibCaczocG
    Fixes: C041.heic
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
    Found during triage of the security report GL61hVKFlOuU

diff --git a/fftools/ffmpeg_mux.c b/fftools/ffmpeg_mux.c
index 9e7ebd3016..a6991afd87 100644
--- a/fftools/ffmpeg_mux.c
+++ b/fftools/ffmpeg_mux.c
@@ -166,9 +166,7 @@ static int mux_fixup_ts(Muxer *mux, MuxStream *ms, AVPacket *pkt)
             av_log(ost, AV_LOG_WARNING, "Invalid DTS: %"PRId64" PTS: %"PRId64", replacing by guess\n",
                    pkt->dts, pkt->pts);
             pkt->pts =
-            pkt->dts = pkt->pts + pkt->dts + ms->last_mux_dts + 1
-                     - FFMIN3(pkt->pts, pkt->dts, ms->last_mux_dts + 1)
-                     - FFMAX3(pkt->pts, pkt->dts, ms->last_mux_dts + 1);
+            pkt->dts = av_clip64(ms->last_mux_dts, pkt->pts - 1, pkt->dts - 1) + 1;
         }
         if ((ost->type == AVMEDIA_TYPE_AUDIO || ost->type == AVMEDIA_TYPE_VIDEO || ost->type == AVMEDIA_TYPE_SUBTITLE) &&
             pkt->dts != AV_NOPTS_VALUE &&