Commit be21a3957c for ffmpeg

commit be21a3957cd6d0e0ddb3511f70f950402f3f5597
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Sep 19 20:48:10 2026 +0200

    avformat/rtpdec_qdm2: Reject block_size larger than the reassembly buffer

    Fixes: unbounded allocation
    Fixes: qdm2_e2e.sdp / gen_qdm2_e2e.py
    Fixes: mrpG6wsAlxwu
    Found-by: Dubh3 <dubh3@qq.com>
    Suggested-by: Dubh3 <dubh3@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/rtpdec_qdm2.c b/libavformat/rtpdec_qdm2.c
index 9d71fe67dd..fe43954eec 100644
--- a/libavformat/rtpdec_qdm2.c
+++ b/libavformat/rtpdec_qdm2.c
@@ -105,6 +105,9 @@ static int qdm2_parse_config(PayloadContext *qdm, AVStream *st,
                 if (item_len < 30)
                     return AVERROR_INVALIDDATA;

+                if (AV_RB32(p + 26) > sizeof(qdm->buf[0]))
+                    return AVERROR_INVALIDDATA;
+
                 ret = ff_alloc_extradata(st->codecpar, 26 + item_len);
                 if (ret < 0) {
                     return ret;