diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c
index dcca6430c4..62f60be437 100644
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -308,17 +308,21 @@ int ff_cbs_write_packet(CodedBitstreamContext *ctx,
                         AVPacket *pkt,
                         CodedBitstreamFragment *frag)
 {
+    AVBufferRef *buf;
     int err;
 
     err = ff_cbs_write_fragment_data(ctx, frag);
     if (err < 0)
         return err;
 
-    err = av_new_packet(pkt, frag->data_size);
-    if (err < 0)
-        return err;
+    av_assert0(frag->data_ref);
+    buf = av_buffer_ref(frag->data_ref);
+    if (!buf)
+        return AVERROR(ENOMEM);
 
-    memcpy(pkt->data, frag->data, frag->data_size);
+    av_init_packet(pkt);
+    pkt->buf  = buf;
+    pkt->data = frag->data;
     pkt->size = frag->data_size;
 
     return 0;
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 5ad0f2b500..5585831cf6 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -1298,7 +1298,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
         max_size += 3 + frag->units[i].data_size * 3 / 2;
     }
 
-    data = av_malloc(max_size);
+    data = av_malloc(max_size + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!data)
         return AVERROR(ENOMEM);
 
@@ -1349,11 +1349,13 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
     }
 
     av_assert0(dp <= max_size);
-    err = av_reallocp(&data, dp);
+    err = av_reallocp(&data, dp + AV_INPUT_BUFFER_PADDING_SIZE);
     if (err)
         return err;
+    memset(data + dp, 0, AV_INPUT_BUFFER_PADDING_SIZE);
 
-    frag->data_ref = av_buffer_create(data, dp, NULL, NULL, 0);
+    frag->data_ref = av_buffer_create(data, dp + AV_INPUT_BUFFER_PADDING_SIZE,
+                                      NULL, NULL, 0);
     if (!frag->data_ref) {
         av_freep(&data);
         return AVERROR(ENOMEM);
diff --git a/libavcodec/cbs_mpeg2.c b/libavcodec/cbs_mpeg2.c
index 5bb2e1e107..bfb64a0851 100644
--- a/libavcodec/cbs_mpeg2.c
+++ b/libavcodec/cbs_mpeg2.c
@@ -369,7 +369,7 @@ static int cbs_mpeg2_assemble_fragment(CodedBitstreamContext *ctx,
     for (i = 0; i < frag->nb_units; i++)
         size += 3 + frag->units[i].data_size;
 
-    frag->data_ref = av_buffer_alloc(size);
+    frag->data_ref = av_buffer_alloc(size + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!frag->data_ref)
         return AVERROR(ENOMEM);
     data = frag->data_ref->data;
@@ -388,6 +388,7 @@ static int cbs_mpeg2_assemble_fragment(CodedBitstreamContext *ctx,
 
     av_assert0(dp == size);
 
+    memset(data + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
     frag->data      = data;
     frag->data_size = size;