[prostomarkeloff]

Found with find-dup-defs using its converge pass, which flagged these parsers against their siblings (h265parser vs h264parser; fmp4io vs mp4io) as near-duplicates that had dropped a guard.

Two denial-of-service defects when parsing untrusted media:

1. codec/h265parser AVCDecoderConfRecord.Unmarshal reads the SPS and PPS counts (b[n]) after two n++ increments with no bounds check, unlike the h264parser twin which guards each count read with if len(b) < n+1 { return ErrDecconfInvalid }. A ~30-byte truncated HEVC decoder-config record drives b[n] past the end → index out of range panic. Fix: add the same guards before reading spscount and ppscount.

2. format/fmp4/fmp4io box-reading loops advance by the child box's declared size (n += size) with only an upper-bound len(b) < n+size check. A child box with size == 0 never advances n, so the loop appends children forever and allocates without bound. The format/mp4/mp4io twins cap this (len(self.Unknowns) > 100 → error); fmp4io had no guard. Fix: add if size < 8 { ... return } (a box cannot be smaller than its own 8-byte header) to each of the 14 loops.

Regression tests: a truncated hvcC record (h265parser) and a zero-size child box (fmp4io, compared against the mp4io twin) — each panics/hangs before the change and returns an error after.

Disclosure: prepared with the help of an AI tool; I have reviewed the changes and tests and understand each line.