Commit e64998a484 for ffmpeg

commit e64998a4840a74447648e920410ecbd3ce3c1c1a
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Sep 29 17:33:36 2026 +0200

    avfilter: allocate the writable copy of a frame with the frame's size

    ff_inlink_make_frame_writable() allocated the copy with the link's size,
    so for a filter handling frames whose size differs from the link the
    copy failed for a larger frame and blended a smaller one into a stale
    size. Frames matching the link are unaffected.

    Found during triage of the security report RqgTntCAW2qN.

diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c
index c696d37aab..1132ab7026 100644
--- a/libavfilter/avfilter.c
+++ b/libavfilter/avfilter.c
@@ -1600,7 +1600,7 @@ int ff_inlink_make_frame_writable(AVFilterLink *link, AVFrame **rframe)

     switch (link->type) {
     case AVMEDIA_TYPE_VIDEO:
-        out = ff_get_video_buffer(link, link->w, link->h);
+        out = ff_get_video_buffer(link, frame->width, frame->height);
         break;
     case AVMEDIA_TYPE_AUDIO:
         out = ff_get_audio_buffer(link, frame->nb_samples);