Commit c2d0a6e5f4 for ffmpeg

commit c2d0a6e5f4091a017c39b93fd5142cd65769daa1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 07:25:51 2026 +0200

    avformat/apngenc: Reject new extradata larger than INT_MAX

    The fix is one of the two recommended in the report.

    Fixes: out of array access (unsupported av_max_alloc() > 2gb)
    Fixes: zqJ6u5YsGyma
    Fixes: AISLE-2026-0111-00586
    Fixes: AISLE-2026-0110-00586
    Negative size memcpy Replicated through API with ASAN, with av_max_alloc() raised above 2 GiB
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/apngenc.c b/libavformat/apngenc.c
index 0d56d784f2..f7fefa34a4 100644
--- a/libavformat/apngenc.c
+++ b/libavformat/apngenc.c
@@ -120,6 +120,8 @@ static int flush_packet(AVFormatContext *format_context, AVPacket *packet)
     side_data = av_packet_get_side_data(apng->prev_packet, AV_PKT_DATA_NEW_EXTRADATA, &side_data_size);

     if (side_data_size) {
+        if (side_data_size > INT_MAX)
+            return AVERROR(EINVAL);
         av_freep(&apng->extra_data);
         apng->extra_data = av_mallocz(side_data_size + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!apng->extra_data)