Commit ebd451b62f for ffmpeg

commit ebd451b62f28111e3d88770d304a56bea9a736cc
Author: zhang xingxing <2388969553@qq.com>
Date:   Tue Oct 13 06:39:23 2026 +0200

    avcodec/mediacodecdec: escape a 00 00 0x sequence ending on the last byte of a parameter set

    This is not a security issue.

    Fixes: D8dV7mhIc12c
    Fixes: swarm-Off-by-one-error-in-NALU-escape-loop-459f43
    Regression since: 88d9c30cf5
    Verified with h2645_ps_to_nalu() compiled standalone; the decoder itself was not run (Android only)
    Found-by: zhang xingxing <2388969553@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/mediacodecdec.c b/libavcodec/mediacodecdec.c
index 89f8ed54a8..0551370a54 100644
--- a/libavcodec/mediacodecdec.c
+++ b/libavcodec/mediacodecdec.c
@@ -99,7 +99,7 @@ static int h2645_ps_to_nalu(const uint8_t *src, int src_size, uint8_t **out, int

     /* Escape 0x00, 0x00, 0x0{0-3} pattern */
     for (i = 4; i < *out_size; i++) {
-        if (i < *out_size - 3 &&
+        if (i < *out_size - 2 &&
             p[i + 0] == 0 &&
             p[i + 1] == 0 &&
             p[i + 2] <= 3) {