Commit c25546c2d3 for ffmpeg

commit c25546c2d35b647a8afa434eb92af9120d8ec049
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 23:58:54 2026 +0100

    avfilter/vf_owdenoise: copy planes with the correct dimensions

    Fixes: heap-buffer-overflow
    Fixes: GGSK9ga7taB4
    Fixes: RHcGTqZzYSqy

    Found-by: SecBuddyF, Tencent KeenLab (CodeBuddy Security)
    The report covers both errors in the chroma plane copies; the width in
    samples of the luma plane was found during triage of the report.

    Heap out of array read Replicated through UnModified FFmpeg with ASAN

diff --git a/libavfilter/vf_owdenoise.c b/libavfilter/vf_owdenoise.c
index 55d6dd0f22..4d02f8eba1 100644
--- a/libavfilter/vf_owdenoise.c
+++ b/libavfilter/vf_owdenoise.c
@@ -151,6 +151,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
     AVFrame *out;
     const int cw = AV_CEIL_RSHIFT(inlink->w, s->hsub);
     const int ch = AV_CEIL_RSHIFT(inlink->h, s->vsub);
+    const int bytes_per_sample = (s->pixel_depth + 7) / 8;

     if (av_frame_is_writable(in)) {
         out = in;
@@ -172,14 +173,14 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
         if (s->luma_strength > 0) {
             filter(s, out->data[0], out->linesize[0], in->data[0], in->linesize[0], inlink->w, inlink->h, s->luma_strength);
         } else {
-            av_image_copy_plane(out->data[0], out->linesize[0], in ->data[0], in ->linesize[0], inlink->w, inlink->h);
+            av_image_copy_plane(out->data[0], out->linesize[0], in ->data[0], in ->linesize[0], inlink->w * bytes_per_sample, inlink->h);
         }
         if (s->chroma_strength > 0) {
             filter(s, out->data[1], out->linesize[1], in->data[1], in->linesize[1], cw, ch, s->chroma_strength);
             filter(s, out->data[2], out->linesize[2], in->data[2], in->linesize[2], cw, ch, s->chroma_strength);
         } else {
-            av_image_copy_plane(out->data[1], out->linesize[1], in ->data[1], in ->linesize[1], inlink->w, inlink->h);
-            av_image_copy_plane(out->data[2], out->linesize[2], in ->data[2], in ->linesize[2], inlink->w, inlink->h);
+            av_image_copy_plane(out->data[1], out->linesize[1], in ->data[1], in ->linesize[1], cw * bytes_per_sample, ch);
+            av_image_copy_plane(out->data[2], out->linesize[2], in ->data[2], in ->linesize[2], cw * bytes_per_sample, ch);
         }

         if (in->data[3])