Commit a10c197f1e for ffmpeg

commit a10c197f1eddf5f6cb1d22929594b63585dd6369
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:10:21 2026 +0200

    avfilter/vf_median: reject widths whose fine histogram size overflows an int

    Fixes: heap-buffer-overflow (read and write)
    Fixes: signed integer overflow
    Fixes: IhY7QcsV5nva
    Fixes: ANT-2026-RYWQTXHH
    Fixes: poc-median-65600x4.pgm
    Found-by: Claude and Ada Logics

    Out of array access Replicated through UnModified FFmpeg with ASAN and UBSAN

diff --git a/libavfilter/vf_median.c b/libavfilter/vf_median.c
index 3b11adbcad..5398932436 100644
--- a/libavfilter/vf_median.c
+++ b/libavfilter/vf_median.c
@@ -143,6 +143,11 @@ static int config_input(AVFilterLink *inlink)

     s->nb_threads = FFMAX(1, FFMIN(s->planeheight[1] / (s->radiusV + 1), ff_filter_get_nb_threads(inlink->dst)));
     s->bins   = 1 << ((s->depth + 1) / 2);
+    if (inlink->w > INT_MAX / (s->bins * s->bins)) {
+        av_log(inlink->dst, AV_LOG_ERROR, "Width %d is too large for depth %d\n",
+               inlink->w, s->depth);
+        return AVERROR(EINVAL);
+    }
     s->fine_size = s->bins * s->bins * inlink->w;
     s->coarse_size = s->bins * inlink->w;
     s->coarse = av_calloc(s->nb_threads, sizeof(*s->coarse));