Commit 26c2980980 for ffmpeg

commit 26c2980980295e5516f308c5a2792d2a72e43eae
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 29 03:03:39 2026 +0100

    avcodec/gif: remap into a buffer with the context width as stride

    Fixes: out of array write
    Fixes: 8onJqhybXBbq
    Fixes: AISLE-2026-0150-00715
    Out of array write Replicated through UnModified FFmpeg with ASAN

    Found-by: Joshua Rogers (AISLE)

diff --git a/libavcodec/gif.c b/libavcodec/gif.c
index 132ce07e6c..49dd64a2c5 100644
--- a/libavcodec/gif.c
+++ b/libavcodec/gif.c
@@ -300,6 +300,7 @@ static int gif_image_write_image(AVCodecContext *avctx,
     int x_start = 0, y_start = 0, trans = s->transparent_index;
     int bcid = -1, honor_transparency = (s->flags & GF_TRANSDIFF) && s->last_frame && !palette;
     const uint8_t *ptr;
+    int ptr_linesize = linesize;
     uint32_t shrunk_palette[AVPALETTE_COUNT];
     uint8_t map[AVPALETTE_COUNT] = { 0 };
     size_t shrunk_palette_count = 0;
@@ -402,14 +403,15 @@ static int gif_image_write_image(AVCodecContext *avctx,

     if (shrunk_palette_count) {
         if (!s->shrunk_buf) {
-            s->shrunk_buf = av_malloc(avctx->height * linesize);
+            s->shrunk_buf = av_malloc(avctx->height * avctx->width);
             if (!s->shrunk_buf) {
                 av_log(avctx, AV_LOG_ERROR, "Could not allocated remapped frame buffer.\n");
                 return AVERROR(ENOMEM);
             }
         }
-        remap_frame_to_palette(buf, linesize, s->shrunk_buf, linesize, avctx->width, avctx->height, map);
-        ptr = s->shrunk_buf + y_start*linesize + x_start;
+        remap_frame_to_palette(buf, linesize, s->shrunk_buf, avctx->width, avctx->width, avctx->height, map);
+        ptr = s->shrunk_buf + y_start*avctx->width + x_start;
+        ptr_linesize = avctx->width;
     } else {
         ptr = buf + y_start*linesize + x_start;
     }
@@ -423,13 +425,13 @@ static int gif_image_write_image(AVCodecContext *avctx,
                 if (ref[x] == ptr[x])
                     s->tmpl[x] = trans;
             len += ff_lzw_encode(s->lzw, s->tmpl, width);
-            ptr += linesize;
+            ptr += ptr_linesize;
             ref += ref_linesize;
         }
     } else {
         for (y = 0; y < height; y++) {
             len += ff_lzw_encode(s->lzw, ptr, width);
-            ptr += linesize;
+            ptr += ptr_linesize;
         }
     }
     len += ff_lzw_encode_flush(s->lzw);