Commit 8a976f7275 for ffmpeg
commit 8a976f72751b271a95628271bf259c95939cd43f
Author: zhang xingxing <2388969553@qq.com>
Date: Thu Oct 15 04:46:24 2026 +0200
avfilter/vf_stack: use ff_slice_pos() for the per-slice input range
Fixes: GIRN0tvt58WQ
Fixes: swarm-Signed-integer-overflow-in-process_slice-slice-computation-b29bec
Regression since: 631f7acc6c
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c
index 6e9ac60a56..19c4b2c147 100644
--- a/libavfilter/vf_stack.c
+++ b/libavfilter/vf_stack.c
@@ -148,8 +148,8 @@ static int process_slice(AVFilterContext *ctx, void *arg, int job, int nb_jobs)
StackContext *s = ctx->priv;
AVFrame *out = arg;
AVFrame **in = s->frames;
- const int start = (s->nb_inputs * job ) / nb_jobs;
- const int end = (s->nb_inputs * (job+1)) / nb_jobs;
+ const int start = ff_slice_pos(s->nb_inputs, job, nb_jobs);
+ const int end = ff_slice_pos(s->nb_inputs, job + 1, nb_jobs);
for (int i = start; i < end; i++) {
StackItem *item = &s->items[i];