Commit 2c7c0c75e1 for ffmpeg

commit 2c7c0c75e194b42242d6252e4a60935f182aeceb
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 23:30:15 2026 +0100

    avfilter/af_asetnsamples: pad to the sample count the frame was taken with

    Fixes: out of array write
    Fixes: Zvv92YsURhPU

    Found during the triage of a finding from the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25800

    Out of array write Replicated through UnModified FFmpeg with ASAN

diff --git a/libavfilter/af_asetnsamples.c b/libavfilter/af_asetnsamples.c
index 137fab9403..fe4e5bda1d 100644
--- a/libavfilter/af_asetnsamples.c
+++ b/libavfilter/af_asetnsamples.c
@@ -55,22 +55,23 @@ static int activate(AVFilterContext *ctx)
     AVFilterLink *outlink = ctx->outputs[0];
     ASNSContext *s = ctx->priv;
     AVFrame *frame = NULL, *pad_frame;
+    const int nb_samples = ctx->is_disabled ? 0 : s->nb_out_samples;
     int ret;

     FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink);

-    if (ctx->is_disabled)
+    if (!nb_samples)
         ret = ff_inlink_consume_frame(inlink, &frame);
     else
-        ret = ff_inlink_consume_samples(inlink, s->nb_out_samples, s->nb_out_samples, &frame);
+        ret = ff_inlink_consume_samples(inlink, nb_samples, nb_samples, &frame);
     if (ret < 0)
         return ret;

     if (ret > 0) {
-        if (!s->pad || ctx->is_disabled || frame->nb_samples == s->nb_out_samples)
+        if (!s->pad || ctx->is_disabled || frame->nb_samples >= nb_samples)
             return ff_filter_frame(outlink, frame);

-        pad_frame = ff_get_audio_buffer(outlink, s->nb_out_samples);
+        pad_frame = ff_get_audio_buffer(outlink, nb_samples);
         if (!pad_frame) {
             av_frame_free(&frame);
             return AVERROR(ENOMEM);
@@ -86,7 +87,7 @@ static int activate(AVFilterContext *ctx)
         av_samples_copy(pad_frame->extended_data, frame->extended_data,
                         0, 0, frame->nb_samples, frame->ch_layout.nb_channels, frame->format);
         av_samples_set_silence(pad_frame->extended_data, frame->nb_samples,
-                               s->nb_out_samples - frame->nb_samples, frame->ch_layout.nb_channels,
+                               nb_samples - frame->nb_samples, frame->ch_layout.nb_channels,
                                frame->format);
         av_frame_free(&frame);
         return ff_filter_frame(outlink, pad_frame);