Commit 87963d1392 for ffmpeg

commit 87963d13920e757544229c9ad187d9f47cf67b68
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 2 19:49:51 2026 +0200

    avformat/rtpenc: Limit RFC 4175 dimensions to 32767

    Fixes: out of array access
    Fixes: signed integer overflow
    Fixes: rfc4175_overflow.mxf
    Fixes: fKcw8qCE1cYW
    Found-by: Exocija

diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index 7c86b50975..dd08a9bbcb 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -228,9 +228,15 @@ static int rtp_write_header(AVFormatContext *s1)
             s->nal_length_size = (st->codecpar->extradata[21] & 0x03) + 1;
         }
         break;
-    case AV_CODEC_ID_MJPEG:
     case AV_CODEC_ID_BITPACKED:
     case AV_CODEC_ID_RAWVIDEO:
+        if (st->codecpar->width > 32767 || st->codecpar->height > 32767) {
+            av_log(s1, AV_LOG_ERROR, "dimensions %dx%d too large for RFC 4175\n",
+                   st->codecpar->width, st->codecpar->height);
+            return AVERROR(EINVAL);
+        }
+        av_fallthrough;
+    case AV_CODEC_ID_MJPEG:
         if (st->codecpar->width <= 0 || st->codecpar->height <= 0) {
             av_log(s1, AV_LOG_ERROR, "dimensions not set\n");
             return AVERROR(EINVAL);