Commit 8dcba5f266 for ffmpeg

commit 8dcba5f266ee3ccb1ba920939979038aa1d87504
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 06:48:33 2026 +0200

    avformat/asfdec_o: reject packets positioned beyond INT64_MAX/2

    Signed integer overflow Replicated through API with UBSAN

    Fixes: signed integer overflow: -9223372036854754902 - 29780 cannot be represented in type 'int64_t'
    Fixes: 490256472/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5108938455711744
    Fixes: bbbW1GCPwyFw
    Regression since: 736e9e69d5dbbe1d81885dfef59917eb915d2f96

    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c
index 4961c1617a..420324114f 100644
--- a/libavformat/asfdec_o.c
+++ b/libavformat/asfdec_o.c
@@ -1225,7 +1225,7 @@ static int asf_read_packet_header(AVFormatContext *s)

     asf->packet_offset = avio_tell(pb);
     if (asf->packet_offset > INT64_MAX/2)
-        asf->packet_offset = 0;
+        return AVERROR_INVALIDDATA;
     error_flags = avio_r8(pb); // read Error Correction Flags
     if (error_flags & ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT) {
         if (!(error_flags & ASF_ERROR_CORRECTION_LENGTH_TYPE)) {
@@ -1309,7 +1309,8 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
         return AVERROR_EOF;
     while (!pb->eof_reached) {
         if (asf->state == PARSE_PACKET_HEADER) {
-            asf_read_packet_header(s);
+            if ((ret = asf_read_packet_header(s)) < 0)
+                return ret;
             if (pb->eof_reached)
                 break;
             if (!asf->nb_mult_left)