Commit fd3fff8cef for ffmpeg

commit fd3fff8cef8f5e0d1f36e64f38a503f4dd94b036
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Sep 25 05:42:17 2026 +0200

    avcodec/ratecontrol: count the pass-2 log entries without reading past an empty log

    Fixes: heap-buffer-overflow
    Fixes: lAyRPnaxSAiw
    Found during triage/review of the security report d8mJHYOGopsd

diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index ab2c43b8d2..08563ea35b 100644
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -571,9 +571,9 @@ av_cold int ff_rate_control_init(MPVMainEncContext *const m)
         char *p;

         /* find number of pics */
-        p = avctx->stats_in;
-        for (i = -1; p; i++)
-            p = strchr(p + 1, ';');
+        for (i = 0, p = avctx->stats_in;
+             i < INT_MAX / sizeof(RateControlEntry) && p && (p = strchr(p, ';')); i++)
+            p++;
         i += m->max_b_frames;
         if (i <= 0 || i >= INT_MAX / sizeof(RateControlEntry))
             return -1;