Commit b6d737a49c for ffmpeg

commit b6d737a49c3422ea81381851fa49ef750c9fd367
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 27 13:09:30 2026 +0100

    avfilter/af_amerge: check the channel count of each input before summing

    Fixes: signed integer overflow
    Fixes: out of array write
    Fixes: 4T4QtWPFfCiD
    Fixes: Depthfirst issue 019f3b84-908c-7752-be91-62fb35f8911e
    Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN
    The out of array write is a regression since 4e0a8b745a, the overflow
    of the sum is older.

    Found-by: Michael Niedermayer <michael@niedermayer.cc> using Depthfirst
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/af_amerge.c b/libavfilter/af_amerge.c
index 8c574f7bda..07dc804201 100644
--- a/libavfilter/af_amerge.c
+++ b/libavfilter/af_amerge.c
@@ -109,12 +109,12 @@ static int query_formats(AVFilterContext *ctx)
             av_log(ctx, AV_LOG_INFO, "Using \"%s\" for input %d\n", buf, i + 1);
         }
         s->in[i].nb_ch = INLAYOUT(ctx, i)->nb_channels;
+        if (s->in[i].nb_ch > SWR_CH_MAX - nb_ch) {
+            av_log(ctx, AV_LOG_ERROR, "Too many channels (max %d)\n", SWR_CH_MAX);
+            return AVERROR(EINVAL);
+        }
         nb_ch += s->in[i].nb_ch;
     }
-    if (nb_ch > SWR_CH_MAX) {
-        av_log(ctx, AV_LOG_ERROR, "Too many channels (max %d)\n", SWR_CH_MAX);
-        return AVERROR(EINVAL);
-    }
     ret = av_channel_layout_custom_init(&outlayout, nb_ch);
     if (ret < 0)
         return ret;