Commit 12ca9b6890 for ffmpeg

commit 12ca9b6890144346290917bca27ba859b82b5f72
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Oct 15 04:06:26 2026 +0200

    avfilter/vf_pad: do the x/y range check and centering in 64bit

    Fixes: Ilayk1MzOixN
    Fixes: swarm-Signed-integer-overflow-in-pad-x-y-bounds-check-499261
    Regression since: 57c3670896
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Found-by: zhang xingxing <2388969553@qq.com>
    The report suggested, among other options, widening the comparison.
    The overflow in the centering was found during review of the fixes for the report.

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/vf_pad.c b/libavfilter/vf_pad.c
index a3436bb2d6..4891cf2518 100644
--- a/libavfilter/vf_pad.c
+++ b/libavfilter/vf_pad.c
@@ -180,10 +180,10 @@ static int config_input(AVFilterLink *inlink)
         goto eval_fail;
     s->x = var_values[VAR_X] = res;

-    if (s->x < 0 || s->x + inlink->w > s->w)
-        s->x = var_values[VAR_X] = (s->w - inlink->w) / 2;
-    if (s->y < 0 || s->y + inlink->h > s->h)
-        s->y = var_values[VAR_Y] = (s->h - inlink->h) / 2;
+    if (s->x < 0 || (int64_t)s->x + inlink->w > s->w)
+        s->x = var_values[VAR_X] = ((int64_t)s->w - inlink->w) / 2;
+    if (s->y < 0 || (int64_t)s->y + inlink->h > s->h)
+        s->y = var_values[VAR_Y] = ((int64_t)s->h - inlink->h) / 2;

     s->w    = ff_draw_round_to_sub(&s->draw, 0, -1, s->w);
     s->h    = ff_draw_round_to_sub(&s->draw, 1, -1, s->h);