Commit 7f80b2ad83 for ffmpeg

commit 7f80b2ad83f37a4998d9617495c92b28a7339a90
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 06:49:22 2026 +0200

    avcodec/dvbsubenc: Account for the full CLUT segment header

    Fixes: out of array write
    Fixes: IRdTPagGrTLk
    Heap out of array write Replicated through UnModified FFmpeg with ASAN
    Found-by: Secbuddy, Tencent Keen Security Lab (tested by kvartet)

diff --git a/libavcodec/dvbsubenc.c b/libavcodec/dvbsubenc.c
index 6f42b1f134..c9ff94c2c0 100644
--- a/libavcodec/dvbsubenc.c
+++ b/libavcodec/dvbsubenc.c
@@ -360,7 +360,7 @@ static int dvbsub_encode(AVCodecContext *avctx, uint8_t *outbuf, int buf_size,
                 return AVERROR(EINVAL);
             }

-            if (buf_size < 6 + h->rects[clut_id]->nb_colors * 6)
+            if (buf_size < 8 + h->rects[clut_id]->nb_colors * 6)
                 return AVERROR_BUFFER_TOO_SMALL;

             /* CLUT segment */
@@ -391,7 +391,7 @@ static int dvbsub_encode(AVCodecContext *avctx, uint8_t *outbuf, int buf_size,
             }

             bytestream_put_be16(&pseg_len, q - pseg_len - 2);
-            buf_size -= 6 + h->rects[clut_id]->nb_colors * 6;
+            buf_size -= 8 + h->rects[clut_id]->nb_colors * 6;
         }

         if (buf_size < h->num_rects * 22)