Commit aed107eb70 for ffmpeg

commit aed107eb70bfca16ce0c36f44b7439db61ee5a55
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 16:33:22 2026 +0100

    avformat/imf_cpl: reject an EditRate that is not positive

    Fixes: -nan is outside the range of representable values of type 'long'
    Fixes: Assertion c > 0 failed at libavutil/mathematics.c
    Fixes: A5TJ4YnA1yYe

    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25795

    Undefined behavior Replicated through UnModified FFmpeg with UBSAN

diff --git a/libavformat/imf.h b/libavformat/imf.h
index ef124bf412..3cba33a721 100644
--- a/libavformat/imf.h
+++ b/libavformat/imf.h
@@ -183,7 +183,7 @@ void ff_imf_cpl_free(FFIMFCPL *cpl);
 int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number);

 /**
- * Reads an AVRational from an XML element
+ * Reads a positive AVRational from an XML element
  * @return 0 on success, < 0 AVERROR code on error.
  */
 int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational);
diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index 0edfcbec03..3846d34d77 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -90,7 +90,8 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
     int ret = 0;

     xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
-    if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
+    if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2
+        || rational->num <= 0 || rational->den <= 0)
         ret = AVERROR_INVALIDDATA;
     xmlFree(element_text);