Commit e06b3953d4 for ffmpeg

commit e06b3953d4253f8b56271628ba4083fde96aeadb
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 24 05:47:15 2026 +0200

    avcodec/libxevd: check the NAL unit length against the remaining packet data

    Fixes: out of array read
    Fixes: 5sHdL1UwYoZ2 (AISLE-2026-0150-00006)
    Out of array read Replicated through UnModified FFmpeg with ASAN
    Out of array read Replicated through API with ASAN
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavcodec/libxevd.c b/libavcodec/libxevd.c
index dd8ffb2f6a..7db7ec6dc3 100644
--- a/libavcodec/libxevd.c
+++ b/libavcodec/libxevd.c
@@ -348,7 +348,7 @@ static int libxevd_receive_frame(AVCodecContext *avctx, AVFrame *frame)
             memset(&stat, 0, sizeof(XEVD_STAT));

             nalu_size = read_nal_unit_length(pkt_au->data + bs_read_pos, XEVD_NAL_UNIT_LENGTH_BYTE, avctx);
-            if (nalu_size == 0) {
+            if (nalu_size <= 0 || nalu_size > pkt_au->size - bs_read_pos - XEVD_NAL_UNIT_LENGTH_BYTE) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid bitstream\n");
                 av_packet_free(&pkt_au);
                 ret = AVERROR_INVALIDDATA;