Commit 3092ee5a9c for ffmpeg

commit 3092ee5a9cae1e8d5724989f7f4c1535816bf79a
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 07:24:31 2026 +0200

    avfilter/vf_tonemap: pass the alpha row width, not the linesize, to av_image_copy_plane()

    Fixes: negative-size-param
    Fixes: assertion failure
    Fixes: wzomtdUBffdP
    Fixes: ANT-2026-G2YFQ5N2
    Fixes: poc.exr
    Found-by: Claude and Ada Logics

    Negative size memcpy and assertion failure Replicated through UnModified FFmpeg with ASAN

diff --git a/libavfilter/vf_tonemap.c b/libavfilter/vf_tonemap.c
index c5be4b1510..40bed9b394 100644
--- a/libavfilter/vf_tonemap.c
+++ b/libavfilter/vf_tonemap.c
@@ -263,7 +263,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
     if (desc->flags & AV_PIX_FMT_FLAG_ALPHA && odesc->flags & AV_PIX_FMT_FLAG_ALPHA) {
         av_image_copy_plane(out->data[3], out->linesize[3],
                             in->data[3], in->linesize[3],
-                            out->linesize[3], outlink->h);
+                            out->width * odesc->comp[3].step, outlink->h);
     } else if (odesc->flags & AV_PIX_FMT_FLAG_ALPHA) {
         for (y = 0; y < out->height; y++) {
             for (x = 0; x < out->width; x++) {