Commit 297395de11 for ffmpeg

commit 297395de11cd1f0ad7841c05dab87d9c7075faea
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 15:25:11 2026 +0100

    avfilter/vf_vibrance: offset the 8-bit planar source by the source linesize

    Regression since 725328672a.

    Fixes: out of array read
    Fixes: qafvJhC3VKaH
    Fixes: swarm-Source-pointer-initialized-using-destination-linesize-in-vibrance_slice8-3c9b5e

    Found-by: zhang xingxing <2388969553@qq.com>

    Out of array read Replicated through UnModified FFmpeg with ASAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/vf_vibrance.c b/libavfilter/vf_vibrance.c
index 295e582412..273532e750 100644
--- a/libavfilter/vf_vibrance.c
+++ b/libavfilter/vf_vibrance.c
@@ -85,9 +85,9 @@ static int vibrance_slice8(AVFilterContext *avctx, void *arg, int jobnr, int nb_
     const ptrdiff_t bslinesize = in->linesize[1];
     const ptrdiff_t rslinesize = in->linesize[2];
     const ptrdiff_t aslinesize = in->linesize[3];
-    const uint8_t *gsrc = in->data[0] + slice_start * glinesize;
-    const uint8_t *bsrc = in->data[1] + slice_start * blinesize;
-    const uint8_t *rsrc = in->data[2] + slice_start * rlinesize;
+    const uint8_t *gsrc = in->data[0] + slice_start * gslinesize;
+    const uint8_t *bsrc = in->data[1] + slice_start * bslinesize;
+    const uint8_t *rsrc = in->data[2] + slice_start * rslinesize;
     uint8_t *gptr = frame->data[0] + slice_start * glinesize;
     uint8_t *bptr = frame->data[1] + slice_start * blinesize;
     uint8_t *rptr = frame->data[2] + slice_start * rlinesize;