avfilter/vf_deflicker: fix invalid access

Fixes #8253

diff --git a/libavfilter/vf_deflicker.c b/libavfilter/vf_deflicker.c
index b038b977f62484f36aaf346c05da48cbec32f717..ea3f430a05e90e6bdea83bf9b7b7041912cbd6bb 100644 (file)
--- a/libavfilter/vf_deflicker.c
+++ b/libavfilter/vf_deflicker.c
@@ -420,7 +420,10 @@ static int request_frame(AVFilterLink *outlink)
 
     ret = ff_request_frame(ctx->inputs[0]);
     if (ret == AVERROR_EOF && s->available > 0) {
-        AVFrame *buf = av_frame_clone(ff_bufqueue_peek(&s->q, s->size - 1));
+        AVFrame *buf = ff_bufqueue_peek(&s->q, s->available - 1);
+        if (!buf)
+            return AVERROR(ENOMEM);
+        buf = av_frame_clone(buf);
         if (!buf)
             return AVERROR(ENOMEM);