Commit dbadab2d8a for ffmpeg

commit dbadab2d8a925e783895af8cf3f30803224db81a
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Nov 6 23:13:42 2026 +0100

    avfilter/af_adeclick: check the size of the interpolation matrix

    Fixes: signed integer overflow: 65537 * 65537 cannot be represented in type 'int'
    Fixes: out of array write
    Fixes: gqEpoZGEUAEO

    Found-by: SecBuddyF, Tencent KeenLab (CodeBuddy Security)

    Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN

diff --git a/libavfilter/af_adeclick.c b/libavfilter/af_adeclick.c
index 198e7fab63..ffd0bfbaa3 100644
--- a/libavfilter/af_adeclick.c
+++ b/libavfilter/af_adeclick.c
@@ -399,6 +399,9 @@ static int interpolation(DeclickChannel *c, const double *src, int ar_order,
     double *vector, *matrix;
     int i, j;

+    if (nb_errors > INT_MAX / sizeof(*c->matrix) / nb_errors)
+        return AVERROR(ENOMEM);
+
     av_fast_malloc(&c->matrix, &c->matrix_size, nb_errors * nb_errors * sizeof(*c->matrix));
     matrix = c->matrix;
     if (!matrix)