lavfi/alphaextract: fix assignment of invalid size value to memcpy in case linesize < 0

Fix crash, for example in the command:
ffmpeg -f image2 -vcodec pgmyuv -i tests/vsynth1/%02d.pgm \
  -vf "[in]format=yuv420p,split,alphamerge,split[o3][o4];
       [o4]vflip,alphaextract[alpha];[o3][alpha]alphamerge[out]" \
  -vcodec rawvideo -f nut md5:

diff --git a/libavfilter/vf_alphaextract.c b/libavfilter/vf_alphaextract.c
index 60de6ac2bab9573573494f9d7ff788d145904a44..f930c51290d56be23e833295c3318b90df53d035 100644 (file)
--- a/libavfilter/vf_alphaextract.c
+++ b/libavfilter/vf_alphaextract.c
@@ -87,7 +87,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *cur_buf)
             }
         }
     } else {
-        const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]);
+        const int linesize = abs(FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]));
         int y;
         for (y = 0; y < out_buf->video->h; y++) {
             memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],