Commit d9b151c967 for ffmpeg

commit d9b151c9676ab134434ca28a5c56df08aff605ec
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 00:00:14 2026 +0100

    avformat/mux: do not overflow the default block_align computation

    Fixes: 6nHC3ciDJMZ6
    Fixes: signed integer overflow
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
    Found during triage of the security report Zc8wjsgxLWvu

diff --git a/libavformat/mux.c b/libavformat/mux.c
index 8226840b4c..ba64888260 100644
--- a/libavformat/mux.c
+++ b/libavformat/mux.c
@@ -241,9 +241,16 @@ static int init_muxer(AVFormatContext *s, AVDictionary **options)
                 goto fail;
             }

-            if (!par->block_align)
-                par->block_align = par->ch_layout.nb_channels *
-                                   av_get_bits_per_sample(par->codec_id) >> 3;
+            if (!par->block_align) {
+                int64_t block_align = (int64_t)par->ch_layout.nb_channels *
+                                      av_get_bits_per_sample(par->codec_id) >> 3;
+                if (block_align < 0 || block_align > INT_MAX) {
+                    av_log(s, AV_LOG_ERROR, "invalid channel count\n");
+                    ret = AVERROR(EINVAL);
+                    goto fail;
+                }
+                par->block_align = block_align;
+            }
             break;
         case AVMEDIA_TYPE_VIDEO:
             if ((par->width <= 0 || par->height <= 0) &&