Commit 58c989a73d for ffmpeg

commit 58c989a73db626727da6f38cc18d4250adcabc76
Author: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Date:   Sun Oct 18 22:09:04 2026 +0800

    avfilter/avf_concat: reject the next command on the last segment

    process_command() called flush_segment() without checking that there is a
    next segment. On the last segment this moved cur_idx past the inputs while
    the outputs still wanted frames, so activate() accessed cat->in[] and
    ctx->inputs[] out of bounds and crashed, e.g.

      ffmpeg -f lavfi -i "testsrc2=d=0.2[a];testsrc2=d=1[b];[a][b]concat=n=2,sendcmd=c='0.3 concat next'" -f null -

    Fail the command instead.

    Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>

diff --git a/libavfilter/avf_concat.c b/libavfilter/avf_concat.c
index 531aa071a0..f6a1f758f5 100644
--- a/libavfilter/avf_concat.c
+++ b/libavfilter/avf_concat.c
@@ -444,7 +444,13 @@ static int process_command(AVFilterContext *ctx, const char *cmd, const char *ar
     int ret = AVERROR(ENOSYS);

     if (!strcmp(cmd, "next")) {
+        ConcatContext *cat = ctx->priv;
+
         av_log(ctx, AV_LOG_VERBOSE, "Command received: next\n");
+        if (cat->cur_idx + ctx->nb_outputs >= ctx->nb_inputs) {
+            av_log(ctx, AV_LOG_WARNING, "There is no next segment\n");
+            return AVERROR(EINVAL);
+        }
         return flush_segment(ctx);
     }