Commit f0b1be7b39 for ffmpeg

commit f0b1be7b3903165eda7b2500f9dd43cf344da2e1
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Fri Oct 2 03:25:33 2026 +0200

    swscale/graph: do not copy past the last line in run_copy()

    Use ff_copyPlane() with the width of the line. It still copies equal
    positive linesizes as one block, but ends it with the last line.

    Found during triage of the security report edlOwd4qVGBw.

    Fixes: out of array read
    Fixes: out of array write
    Fixes: negative size memcpy()
    Fixes: xvstjaVdxtut
    Regression since: bf738412e8
    Replicated through API

    ---

    This also fixes copying negative linesizes.

    Signed-off-by: Niklas Haas <git@haasn.dev>

diff --git a/libswscale/graph.c b/libswscale/graph.c
index a980af1ee1..cc8e5cf7a2 100644
--- a/libswscale/graph.c
+++ b/libswscale/graph.c
@@ -298,15 +298,10 @@ static void run_copy(const SwsFrame *out, const SwsFrame *in, int y, int h,

         if (in_data[i] == out_data[i]) {
             av_assert0(in->linesize[i] == out->linesize[i]);
-        } else if (in->linesize[i] == out->linesize[i]) {
-            memcpy(out_data[i], in_data[i], lines * out->linesize[i]);
         } else {
-            const int linesize = FFMIN(out->linesize[i], in->linesize[i]);
-            for (int j = 0; j < lines; j++) {
-                memcpy(out_data[i], in_data[i], linesize);
-                in_data[i]  += in->linesize[i];
-                out_data[i] += out->linesize[i];
-            }
+            ff_copyPlane(in_data[i], in->linesize[i], 0, lines,
+                         av_image_get_linesize(out->format, out->width, i),
+                         out_data[i], out->linesize[i]);
         }
     }
 }