Commit fb188c15a1 for ffmpeg

commit fb188c15a10e498ca06de5a1568ded5d56f30674
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 17:00:22 2026 +0100

    avformat/imfdec: limit the number of resources of a composition

    Every repetition of a resource takes an entry in the resource array of
    its track. A RepeatCount of 44000000 needed 2 GiB for it.

    Fixes: excessive memory allocation
    Fixes: RNdiJLvrqS9c

    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25795

    Excessive memory allocation Replicated through UnModified FFmpeg with time (maximum resident set size)

diff --git a/libavformat/imfdec.c b/libavformat/imfdec.c
index 2aebdc3b8b..6b4bb2ac94 100644
--- a/libavformat/imfdec.c
+++ b/libavformat/imfdec.c
@@ -77,6 +77,7 @@

 #define AVRATIONAL_FORMAT "%d/%d"
 #define AVRATIONAL_ARG(rational) rational.num, rational.den
+#define MAX_RESOURCES FFMIN(1 << 20, INT_MAX / (int)sizeof(IMFVirtualTrackResourcePlaybackCtx))

 /**
  * IMF Asset locator
@@ -125,6 +126,7 @@ typedef struct IMFContext {
     IMFAssetLocatorMap asset_locator_map;
     uint32_t track_count;
     IMFVirtualTrackPlaybackCtx **tracks;
+    uint32_t total_resource_count;
 } IMFContext;

 static int imf_uri_is_url(const char *string)
@@ -483,8 +485,9 @@ static int open_track_file_resource(AVFormatContext *s,
            asset_locator->absolute_uri);

     if (track_file_resource->base.repeat_count
-            > INT_MAX / sizeof(IMFVirtualTrackResourcePlaybackCtx) - track->resource_count)
+            > MAX_RESOURCES - c->total_resource_count)
         return AVERROR(ENOMEM);
+    c->total_resource_count += track_file_resource->base.repeat_count;
     tmp = av_fast_realloc(track->resources,
                           &track->resources_alloc_sz,
                           (track->resource_count + track_file_resource->base.repeat_count)