Commit 9bca133c03 for ffmpeg

commit 9bca133c03662a0a199fb6ddfa6ee2090e01caa1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 06:48:07 2026 +0200

    avformat/mov: saturate the audio pre-roll search time of an edit

    The search for the frame one second before an audio edit subtracted the
    time scale from the edit media time, which overflows for media times
    near INT64_MIN. Any result below the first index entry is clamped to it
    anyway, so saturating the subtraction keeps the search unchanged.

    Signed integer overflow Replicated through API with UBSAN

    Found during triage/review of OSS-Fuzz issue 476170159

    Fixes: signed integer overflow: -9223372036854775808 - 1000 cannot be represented in type 'int64_t'
    Fixes: b9W8hJVNRZGN/neg-audio-min.mp4
    Fixes: b9W8hJVNRZGN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9e6a57d083..cb75544aa4 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4622,7 +4622,7 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
             // Audio decoders like AAC need need a decoder delay samples previous to the current sample,
             // to correctly decode this frame. Hence for audio we seek to a frame 1 sec. before the
             // edit_list_media_time to cover the decoder delay.
-            search_timestamp = FFMAX(search_timestamp - msc->time_scale, e_old[0].timestamp);
+            search_timestamp = FFMAX(av_sat_sub64(search_timestamp, msc->time_scale), e_old[0].timestamp);
         }

         if (find_prev_closest_index(st, e_old, nb_old, tts_data_old, tts_count_old, search_timestamp, 0,