From 8a976f72751b271a95628271bf259c95939cd43f Mon Sep 17 00:00:00 2001 From: zhang xingxing <2388969553@qq.com> Date: Thu, 15 Oct 2026 04:46:24 +0200 Subject: [PATCH] avfilter/vf_stack: use ff_slice_pos() for the per-slice input range Fixes: GIRN0tvt58WQ Fixes: swarm-Signed-integer-overflow-in-process_slice-slice-computation-b29bec Regression since: 631f7acc6c Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: zhang xingxing <2388969553@qq.com> Signed-off-by: Michael Niedermayer --- libavfilter/vf_stack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c index 6e9ac60a56..19c4b2c147 100644 --- a/libavfilter/vf_stack.c +++ b/libavfilter/vf_stack.c @@ -148,8 +148,8 @@ static int process_slice(AVFilterContext *ctx, void *arg, int job, int nb_jobs) StackContext *s = ctx->priv; AVFrame *out = arg; AVFrame **in = s->frames; - const int start = (s->nb_inputs * job ) / nb_jobs; - const int end = (s->nb_inputs * (job+1)) / nb_jobs; + const int start = ff_slice_pos(s->nb_inputs, job, nb_jobs); + const int end = ff_slice_pos(s->nb_inputs, job + 1, nb_jobs); for (int i = start; i < end; i++) { StackItem *item = &s->items[i];