From 092c2d9b72819bcd16b06abd754a55fecc7112c5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 19 Oct 2026 02:15:19 +0200
Subject: [PATCH] avformat/rtpenc: Reject packet sizes too small for the VP9
 payload descriptor

Fixes: infinite loop
Fixes: 2bIuZUVk7KRO
Fixes: ffmpeg -f lavfi -i testsrc=duration=0.2:size=64x64:rate=5 -c:v libvpx-vp9 -strict experimental -f rtp -packetsize 13 /dev/null

Endless loop Replicated through UnModified FFmpeg

Found during triage of the security report TwYfznAFyatl (#22717)
---
 libavformat/rtpenc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index 26f89cd7af..d2a8646a95 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -269,6 +269,7 @@ static int rtp_write_header(AVFormatContext *s1)
             ret = AVERROR_EXPERIMENTAL;
             goto fail;
         }
+        payload_header_size = 1;
         break;
     case AV_CODEC_ID_AV1:
         if (s1->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) {