Furthermore, the flags for H264/HEVC have been updated to those renamed in AMF 1.5.0+, instead of using the old ones that were already marked as deprecated:
The US country_code path in parse_itut_t35_metadata() reads the the provider_code with bytestream2_get_be16u(), which is a unchecked version that does not validate the remaining length before reading.