Commit f02f1707b1 for ffmpeg

commit f02f1707b1318fd8cdf2b2936ce79d0061cdad08
Author: zhang xingxing <2388969553@qq.com>
Date:   Tue Oct 13 06:54:15 2026 +0200

    avcodec/dvbsubdec: check the object segment size before reading its header

    This is not a security issue.

    Fixes: hlm9X3ZdVjBu
    Fixes: swarm-Missing-buf_size-validation-in-dvbsub_parse_object_segment-a29b35

    Found-by: zhang xingxing <2388969553@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c
index 7608a44423..0256e8355d 100644
--- a/libavcodec/dvbsubdec.c
+++ b/libavcodec/dvbsubdec.c
@@ -999,6 +999,9 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx,

     int coding_method, non_modifying_color;

+    if (buf_size < 3)
+        return AVERROR_INVALIDDATA;
+
     object_id = AV_RB16(buf);
     buf += 2;

@@ -1011,6 +1014,8 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx,
     non_modifying_color = ((*buf++) >> 1) & 1;

     if (coding_method == 0) {
+        if (buf_end - buf < 4)
+            return AVERROR_INVALIDDATA;
         top_field_len = AV_RB16(buf);
         buf += 2;
         bottom_field_len = AV_RB16(buf);