Commit 8828574c98 for ffmpeg

commit 8828574c986226dde9ba13ba9e1805025b1b1d96
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 26 01:12:01 2026 +0100

    avcodec/bsf/dovi_split: reject NAL units that do not fit the output length field

    Truncated length field Replicated through UnModified FFmpeg

    Found by a grok bot based audit of the code.

diff --git a/libavcodec/bsf/dovi_split.c b/libavcodec/bsf/dovi_split.c
index dd58b798ee..5d7c44f12b 100644
--- a/libavcodec/bsf/dovi_split.c
+++ b/libavcodec/bsf/dovi_split.c
@@ -193,6 +193,13 @@ static int dovi_split_filter(AVBSFContext *ctx, AVPacket *out)
         int payload_size;
         if (!nal_is_kept(s, &s->pkt.nals[i], &payload, &payload_size))
             continue;
+        if (s->out_nal_length_size && s->out_nal_length_size < 4 &&
+            payload_size >= 1 << (8 * s->out_nal_length_size)) {
+            av_log(ctx, AV_LOG_ERROR, "NAL unit size %d does not fit in %d bytes\n",
+                   payload_size, s->out_nal_length_size);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
         out_size += prefix_size + payload_size;
         kept_count++;
     }