From 45f98d0819efe2b7ce93e9034b7e6a4ed6700621 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 24 Oct 2026 06:38:34 +0200
Subject: [PATCH] avcodec/huffyuvenc: reject frames too small for the median
 predictor

SEGV Replicated through UnModified FFmpeg with ASAN (width 2)
Out of array read Replicated through API with ASAN (heights 1 and 2)

Fixes: out of array access
Fixes: m5jVlJdov0Lp
Fixes: AISLE-2026-0150-00558

Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/huffyuvenc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/huffyuvenc.c b/libavcodec/huffyuvenc.c
index 9aec2cc462..c9fd80b838 100644
--- a/libavcodec/huffyuvenc.c
+++ b/libavcodec/huffyuvenc.c
@@ -370,6 +370,13 @@ static av_cold int encode_init(AVCodecContext *avctx)
         return AVERROR(EINVAL);
     }
 
+    if (s->predictor == MEDIAN && s->version <= 2 &&
+        (avctx->width < 4 ||
+         AV_CEIL_RSHIFT(avctx->height, s->chroma_v_shift) < 2 + s->interlaced)) {
+        av_log(avctx, AV_LOG_ERROR, "Frame too small for the median predictor\n");
+        return AVERROR(EINVAL);
+    }
+
     avctx->extradata[0] = s->predictor | (s->decorrelate << 6);
     avctx->extradata[2] = s->interlaced ? 0x10 : 0x20;
     if (s->context)