Commit f703292c42 for ffmpeg

commit f703292c421d4193bd87eed646a65d15f83eb884
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Mon Oct 12 02:25:23 2026 +0200

    avfilter/vf_libopencv: reject shapes too big for OpenCV

    Fixes: out of array write
    Fixes: EVA3Y4e693ul
    Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24753
    Out of array write Replicated through UnModified FFmpeg with ASAN

diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c
index cdfa678860..e34bcb9da7 100644
--- a/libavfilter/vf_libopencv.c
+++ b/libavfilter/vf_libopencv.c
@@ -240,6 +240,12 @@ static int parse_iplconvkernel(IplConvKernel **kernel, char *buf, void *log_ctx)
         goto out;
     }

+    if (rows > (INT_MAX - sizeof(IplConvKernel) - 32) / sizeof(int) / cols) {
+        av_log(log_ctx, AV_LOG_ERROR, "Shape size %dx%d is too big\n", cols, rows);
+        ret = AVERROR(EINVAL);
+        goto out;
+    }
+
     if (anchor_x < 0 || anchor_y < 0 || anchor_x >= cols || anchor_y >= rows) {
         av_log(log_ctx, AV_LOG_ERROR,
                "Shape anchor %dx%d is not inside the rectangle with size %dx%d.\n",