Commit 114b6177d3 for ffmpeg

commit 114b6177d36558bc5ac3aeb39a2e70ce05371d24
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 22:51:53 2026 +0100

    avfilter/vf_spp: index the QP table by macroblock for all chroma subsamplings

    Fixes: heap-buffer-overflow
    Fixes: cxHWRwP1s1BE

    Found-by: SecBuddyF, Tencent KeenLab (CodeBuddy Security)

    Heap out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavfilter/vf_spp.c b/libavfilter/vf_spp.c
index 20c9fd4340..1f369ad67f 100644
--- a/libavfilter/vf_spp.c
+++ b/libavfilter/vf_spp.c
@@ -282,8 +282,9 @@ static void filter(SPPContext *p, uint8_t *dst, uint8_t *src,
             if (p->qp) {
                 qp = p->qp;
             } else{
-                const int qps = 3 + is_luma;
-                qp = qp_table[(FFMIN(x, width - 1) >> qps) + (FFMIN(y, height - 1) >> qps) * qp_stride];
+                const int qpsh = 4 - p->hsub * !is_luma;
+                const int qpsv = 4 - p->vsub * !is_luma;
+                qp = qp_table[(FFMIN(x, width - 1) >> qpsh) + (FFMIN(y, height - 1) >> qpsv) * qp_stride];
                 qp = FFMAX(1, ff_norm_qscale(qp, p->qscale_type));
             }
             for (i = 0; i < count; i++) {