From 1bf50fc71cb4e96d62a94999cd3952057ebb81a9 Mon Sep 17 00:00:00 2001
From: NRK <nrk@disroot.org>
Date: Tue, 31 Mar 2026 19:57:17 +0000
Subject: [PATCH] user_shaders: reject nonsense COMPONENTS values

negative values in specific causes out of bound accesses.
---
 video/out/gpu/user_shaders.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/video/out/gpu/user_shaders.c b/video/out/gpu/user_shaders.c
index e036de20d5..eb3aa079e6 100644
--- a/video/out/gpu/user_shaders.c
+++ b/video/out/gpu/user_shaders.c
@@ -266,6 +266,10 @@ static bool parse_hook(struct mp_log *log, struct bstr *body,
                 mp_err(log, "Error while parsing COMPONENTS!\n");
                 return false;
             }
+            if (out->components < 0 || out->components > 4) {
+                mp_err(log, "Invalid COMPONENTS: %d\n", out->components);
+                return false;
+            }
             continue;
         }