Commit 6ca39883bb for ffmpeg

commit 6ca39883bb090e93aa67007ded75470c496360bc
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 02:05:32 2026 +0100

    avfilter/vsrc_mandelbrot: compute the cycle buffer size without overflow

    maxiter + 16 overflows int for maxiter close to INT_MAX.

    Fixes: signed integer overflow
    Fixes: 6TKPc39mkuWR

    Found during triage of the security report LPW4jFrf2FjP

    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/vsrc_mandelbrot.c b/libavfilter/vsrc_mandelbrot.c
index 0d0e28e8fa..7f9d86b1d6 100644
--- a/libavfilter/vsrc_mandelbrot.c
+++ b/libavfilter/vsrc_mandelbrot.c
@@ -131,7 +131,7 @@ static av_cold int init(AVFilterContext *ctx)
     s->cache_used = 0;
     s->point_cache= av_malloc_array(s->cache_allocated, sizeof(*s->point_cache));
     s-> next_cache= av_malloc_array(s->cache_allocated, sizeof(*s-> next_cache));
-    s-> zyklus    = av_malloc_array(s->maxiter + 16, sizeof(*s->zyklus));
+    s-> zyklus    = av_malloc_array(s->maxiter + 16LL, sizeof(*s->zyklus));

     if (!s->point_cache || !s->next_cache || !s->zyklus)
         return AVERROR(ENOMEM);