Commit 903239c4eb for ffmpeg

commit 903239c4ebfdad70ca2d976007ed92301845cba2
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Thu Sep 24 00:50:13 2026 +0200

    avfilter/af_alimiter: compute the buffer size without int overflow

    Fixes: out of array access
    Fixes: signed integer overflow
    Fixes: pkKQIDVxuWvP/testcase/alimiter-overflow.wav
    Fixes: pkKQIDVxuWvP
    Found-by: mzfr <security@mzfr.me>

diff --git a/libavfilter/af_alimiter.c b/libavfilter/af_alimiter.c
index 61ea7beb6f..8ef6d74afd 100644
--- a/libavfilter/af_alimiter.c
+++ b/libavfilter/af_alimiter.c
@@ -360,10 +360,10 @@ static int config_input(AVFilterLink *inlink)
 {
     AVFilterContext *ctx = inlink->dst;
     AudioLimiterContext *s = ctx->priv;
-    int obuffer_size;
+    int64_t obuffer_size;

-    obuffer_size = inlink->sample_rate * inlink->ch_layout.nb_channels * 100 / 1000. + inlink->ch_layout.nb_channels;
-    if (obuffer_size < inlink->ch_layout.nb_channels)
+    obuffer_size = inlink->sample_rate * (int64_t)inlink->ch_layout.nb_channels / 10 + inlink->ch_layout.nb_channels;
+    if (obuffer_size > INT_MAX)
         return AVERROR(EINVAL);

     s->buffer = av_calloc(obuffer_size, sizeof(*s->buffer));