virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-10-06 05:47:18 +02:00
Code Issues Releases Activity

avcodec/dxv: Use av_fast_realloc() and clear all new space

Browse Source 
The code writing in the buffer has a wide range of error checks
which simply leave it partly uninitialized.

Initializing it on allocation ensures no sensitive data leaks and that
bugs are more reliably reproduceable

Fixes: use of uninitialized memory
Fixes: 435225510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-4521918634196992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a0b793737)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-08-07 19:56:53 +02:00
parent da3f5273fc
commit f2507dba3b
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/dxv.c
View File

@@ -38,6 +38,7 @@ typedef struct DXVContext {
GetByteContext gbc;
uint8_t *tex_data; // Compressed texture
unsigned tex_data_size;
uint8_t *ctex_data; // Compressed chroma texture
unsigned ctex_data_size;
@@ -972,9 +973,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) *
avctx->coded_height / TEXTURE_BLOCK_H *
texdsp_ctx.tex_ratio;
ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (ret < 0)
return ret;
unsigned old_size = ctx->tex_data_size;
void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!ptr)
return AVERROR(ENOMEM);
ctx->tex_data = ptr;
if (ctx->tex_data_size > old_size)
memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size);
if (avctx->pix_fmt != AV_PIX_FMT_RGBA) {
int i;
@@ -1086,6 +1092,8 @@ static av_cold int dxv_close(AVCodecContext *avctx)
DXVContext *ctx = avctx->priv_data;
av_freep(&ctx->tex_data);
ctx->tex_data_size = 0;
av_freep(&ctx->ctex_data);
ctx->ctex_data_size = 0;