Commit 9a861e9687 for ffmpeg

commit 9a861e9687d30e657d59521817cad18405995983
Author: Marvin Scholz <epirat07@gmail.com>
Date:   Tue Sep 29 00:30:35 2026 +0000

    lavf/cafdec: prevent signed integer overflow

    Ensure that adding priming and caf->remainder will not overflow st->nb_frames.

    Signed-off-by: Marvin Scholz <epirat07@gmail.com>

diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index 41ae1bc121..fae4d7db5e 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -277,6 +277,8 @@ static int read_pakt_chunk(AVFormatContext *s, int64_t size)
     st->nb_frames  = avio_rb64(pb); /* valid frames */
     priming        = avio_rb32(pb); /* priming frames */
     caf->remainder = avio_rb32(pb); /* remainder frames */
+    if (st->nb_frames < 0 || INT64_MAX - priming - caf->remainder < st->nb_frames)
+        return AVERROR_INVALIDDATA;

     caf->frame_cnt = -(int64_t)priming;
     st->codecpar->initial_padding = priming;