Commit f8860aebb1 for ffmpeg

commit f8860aebb1dfc168ed6613e1fc15b826811ab35e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:15:39 2026 +0200

    avformat/asfdec_o: deinterleave spread audio completely

    Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

    Found during triage/review of OSS-Fuzz issues 472415045 and 490256472

    Fixes: use of uninitialized memory
    Fixes: mPhE3ApFVs7s

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c
index cb721993b2..2748609b9e 100644
--- a/libavformat/asfdec_o.c
+++ b/libavformat/asfdec_o.c
@@ -672,6 +672,8 @@ static int asf_read_stream_properties(AVFormatContext *s, const GUIDParseTable *
                 asf_st->virtual_chunk_len = avio_rl16(pb);
                 if (!asf_st->virtual_chunk_len || !asf_st->virtual_pkt_len)
                     return AVERROR_INVALIDDATA;
+                if (asf_st->virtual_pkt_len % asf_st->virtual_chunk_len)
+                    asf_st->span = 1;
                 avio_skip(pb, err_data_len - 5);
             } else
                 avio_skip(pb, err_data_len - 1);
@@ -1279,17 +1281,9 @@ static int asf_deinterleave(AVFormatContext *s, ASFPacket *asf_pkt, int st_num)
         return AVERROR(ENOMEM);
     memset(data + asf_pkt->data_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);

-    while (asf_pkt->data_size >= asf_st->span * pkt_len + pos) {
-        if (pos >= asf_pkt->data_size) {
-            break;
-        }
-        for (l = 0; l < pkt_len; l++) {
-            if (pos >= asf_pkt->data_size) {
-                break;
-            }
+    while (asf_pkt->data_size - pos >= asf_st->span * pkt_len) {
+        for (l = 0; l < nchunks; l++) {
             for (j = 0; j < asf_st->span; j++) {
-                if ((pos + chunk_len) >= asf_pkt->data_size)
-                    break;
                 memcpy(data + pos,
                        p + (j * nchunks + l) * chunk_len,
                        chunk_len);
@@ -1297,9 +1291,8 @@ static int asf_deinterleave(AVFormatContext *s, ASFPacket *asf_pkt, int st_num)
             }
         }
         p += asf_st->span * pkt_len;
-        if (p > asf_pkt->avpkt->data + asf_pkt->data_size)
-            break;
     }
+    memcpy(data + pos, p, asf_pkt->data_size - pos);
     av_packet_unref(asf_pkt->avpkt);
     ret = av_packet_from_data(asf_pkt->avpkt, data, asf_pkt->data_size);
     if (ret < 0)