File ffmpeg-7-CVE-2026-66041.patch of Package A_tw-ffmpeg-7

From 4da9812e25894fb51d62a8875cfa8eb39b5e20f5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 28 Jun 2026 15:33:38 +0200
Subject: [PATCH] avfilter/vf_quirc: resize the quirc buffers when the input
 size changes

Fixes: out of array access
Fixes: JbvzNObhorBp
Fixes: 030e140145 (lavfi: add quirc filter)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_quirc.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/libavfilter/vf_quirc.c b/libavfilter/vf_quirc.c
index 59dc84caa8..d2ba48e7bc 100644
--- a/libavfilter/vf_quirc.c
+++ b/libavfilter/vf_quirc.c
@@ -36,6 +36,7 @@ typedef struct QuircContext {
     const AVClass *class;
 
     struct quirc *quirc;
+    int width, height;
 } QuircContext;
 
 static av_cold int init(AVFilterContext *ctx)
@@ -67,6 +68,8 @@ static int config_input(AVFilterLink *inlink)
     if (err == -1) {
         return AVERROR(ENOMEM);
     }
+    quirc->width  = inlink->w;
+    quirc->height = inlink->h;
 
     return 0;
 }
@@ -80,6 +83,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
     int codes_count;
     uint8_t *image;
 
+    if (quirc->width != inlink->w || quirc->height != inlink->h) {
+        if (quirc_resize(quirc->quirc, inlink->w, inlink->h) < 0) {
+            av_frame_free(&frame);
+            return AVERROR(ENOMEM);
+        }
+        quirc->width  = inlink->w;
+        quirc->height = inlink->h;
+    }
+
     /* copy input image to quirc buffer */
     image = quirc_begin(quirc->quirc, NULL, NULL);
     av_image_copy_plane(image, inlink->w,
-- 
2.54.0