Commit ff53919a2d for ffmpeg

commit ff53919a2d8442058d58ba0e83d16cc9e29d73fb
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Oct 7 04:50:42 2026 +0200

    avformat/img2enc: Compute the split plane sizes in 64 bit

    64 bit plane sizes and rejecting non-positive dimensions were suggested in the report.

    Fixes: out of array read
    Fixes: signed integer overflow
    Fixes: PbVEU2cWUlo7
    Fixes: AISLE-2026-0111-00134
    Out of array read Replicated through UnModified FFmpeg with ASAN
    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c
index 1296da8ec7..5a39a1b0c0 100644
--- a/libavformat/img2enc.c
+++ b/libavformat/img2enc.c
@@ -279,13 +279,15 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
     av_bprint_finalize(&filename, NULL);

     if (img->split_planes) {
-        int ysize = par->width * par->height;
-        int usize = AV_CEIL_RSHIFT(par->width, desc->log2_chroma_w) * AV_CEIL_RSHIFT(par->height, desc->log2_chroma_h);
+        int64_t ysize = (int64_t)par->width * par->height;
+        int64_t usize = (int64_t)AV_CEIL_RSHIFT(par->width, desc->log2_chroma_w) * AV_CEIL_RSHIFT(par->height, desc->log2_chroma_h);
         if (desc->comp[0].depth >= 9) {
             ysize *= 2;
             usize *= 2;
         }
-        if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) {
+        if (par->width <= 0 || par->height <= 0 ||
+            ysize > pkt->size ||
+            ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) {
             ret = AVERROR(EINVAL);
             goto fail;
         }