Commit f26d201dd8 for ffmpeg

commit f26d201dd87f36e89ab77b5f689765604c9b06bc
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 03:09:54 2026 +0100

    avcodec/xwdenc: do not read the scanline padding from the frame

    Copy the pixels of the row and write zero padding instead.

    Fixes: out of array read
    Fixes: 3w9JM5wjYYJx
    Fixes: AISLE-2026-0150-00370
    Out of array read Replicated through API with ASAN

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/xwdenc.c b/libavcodec/xwdenc.c
index 1d8b7d9002..378f07950c 100644
--- a/libavcodec/xwdenc.c
+++ b/libavcodec/xwdenc.c
@@ -39,7 +39,7 @@ static int xwd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     uint32_t pixdepth, bpp, bpad, ncolors = 0, lsize, vclass, be = 0;
     uint32_t rgb[3] = { 0 }, bitorder = 0;
     uint32_t header_size;
-    int i, out_size, ret;
+    int i, out_size, ret, row_bytes;
     const uint8_t *ptr;
     uint8_t *buf;
     uint32_t pal[256];
@@ -144,6 +144,7 @@ static int xwd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
         return AVERROR(EINVAL);
     }

+    row_bytes   = (bpp * avctx->width + 7) / 8;
     lsize       = FFALIGN(bpp * avctx->width, bpad) / 8;
     header_size = XWD_HEADER_SIZE + WINDOW_NAME_SIZE;
     out_size    = header_size + ncolors * XWD_CMAP_SIZE + avctx->height * lsize;
@@ -204,7 +205,9 @@ static int xwd_encode_frame(AVCodecContext *avctx, AVPacket *pkt,

     ptr = p->data[0];
     for (i = 0; i < avctx->height; i++) {
-        bytestream_put_buffer(&buf, ptr, lsize);
+        bytestream_put_buffer(&buf, ptr, row_bytes);
+        memset(buf, 0, lsize - row_bytes);
+        buf += lsize - row_bytes;
         ptr += p->linesize[0];
     }