Commit fc75877feb for ffmpeg

commit fc75877feb72ab4d94373bdf1adfa1ee7261b5bc
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 19 02:14:42 2026 +0200

    avformat/rtpenc: Reject packet sizes too small for the MPEG audio payload header

    Fixes: negative-size-param
    Fixes: infinite loop
    Fixes: KX3pF2MSORSh
    Fixes: ffmpeg -f lavfi -i sine=d=0.2 -c:a mp2 -f rtp -packetsize 13 /dev/null

    Negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN

    Found during triage of the security report TwYfznAFyatl (#22717)

diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index 471c988d9c..dff76aab44 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -174,6 +174,7 @@ static int rtp_write_header(AVFormatContext *s1)
     case AV_CODEC_ID_MP2:
     case AV_CODEC_ID_MP3:
         s->buf_ptr = s->buf + 4;
+        payload_header_size = 4;
         avpriv_set_pts_info(st, 32, 1, 90000);
         break;
     case AV_CODEC_ID_MPEG1VIDEO: