Commit 65ca8b1f50 for ffmpeg

commit 65ca8b1f50b850b063bed514330884c74794eeef
Author: zhang xingxing <2388969553@qq.com>
Date:   Tue Oct 13 06:39:23 2026 +0200

    avfilter/vf_crop: keep the x/y expressions when the new ones fail to parse

    This is not a security issue.

    Fixes: 3yfFBPXxhEts
    Fixes: swarm-NULL-pexpr-dereference-after-failed-x-y-runtime-reconfiguration-e3e672
    Regression since: d2b78fe6b7
    NULL pointer dereference Replicated through UnModified FFmpeg with ASAN
    Found-by: zhang xingxing <2388969553@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/vf_crop.c b/libavfilter/vf_crop.c
index e06be77302..f25e0564aa 100644
--- a/libavfilter/vf_crop.c
+++ b/libavfilter/vf_crop.c
@@ -225,17 +225,21 @@ fail_expr:
 static int config_input(AVFilterLink *link)
 {
     CropContext *s = link->dst->priv;
+    AVExpr *x_pexpr = NULL, *y_pexpr = NULL;

     s->var_values[VAR_X] = NAN;
     s->var_values[VAR_Y] = NAN;
-    av_expr_free(s->x_pexpr);
-    av_expr_free(s->y_pexpr);
-    s->x_pexpr = s->y_pexpr = NULL;
-    if (av_expr_parse(&s->x_pexpr, s->x_expr, var_names,
+    if (av_expr_parse(&x_pexpr, s->x_expr, var_names,
                       NULL, NULL, NULL, NULL, 0, link->dst) < 0 ||
-        av_expr_parse(&s->y_pexpr, s->y_expr, var_names,
-                      NULL, NULL, NULL, NULL, 0, link->dst) < 0)
+        av_expr_parse(&y_pexpr, s->y_expr, var_names,
+                      NULL, NULL, NULL, NULL, 0, link->dst) < 0) {
+        av_expr_free(x_pexpr);
         return AVERROR(EINVAL);
+    }
+    av_expr_free(s->x_pexpr);
+    av_expr_free(s->y_pexpr);
+    s->x_pexpr = x_pexpr;
+    s->y_pexpr = y_pexpr;

     return config_crop_area(link);
 }