From 007877d3d037020eb30caca35cccbaadfc571abc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 3 Mar 2026 20:24:36 +0100 Subject: [PATCH] avfilter/vf_scale: Fix integer overflow in config_props() Fixes: signed integer overflow: 536870944 * 16 cannot be represented in type 'int' Fixes: #21587 Found-by: HAORAN FANG Signed-off-by: Michael Niedermayer (cherry picked from commit 9adced32785ce11a5923af12d72c25c0c2907e8b) Signed-off-by: Michael Niedermayer --- libavfilter/vf_scale.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c index ba50fbf492..3223e52f63 100644 --- a/libavfilter/vf_scale.c +++ b/libavfilter/vf_scale.c @@ -505,8 +505,8 @@ static int config_props(AVFilterLink *outlink) if (outlink->w > INT_MAX || outlink->h > INT_MAX || - (outlink->h * inlink->w) > INT_MAX || - (outlink->w * inlink->h) > INT_MAX) + (outlink->h * (uint64_t)inlink->w) > INT_MAX || + (outlink->w * (uint64_t)inlink->h) > INT_MAX) av_log(ctx, AV_LOG_ERROR, "Rescaled value for width or height is too big.\n"); /* TODO: make algorithm configurable */