From f6c95f4f8c2f592c14239baf11a47b42170830e6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 19 Dec 2013 17:14:59 +0100 Subject: [PATCH] avcodec/dxa: add padding to decomp_buf Fixes use of uninitialized memory Fixes part of msan_uninit-mem_7f5ea8284fb7_8317_scummvm.dxa Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/dxa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c index 1d96f10ef4..e6750e95bd 100644 --- a/libavcodec/dxa.c +++ b/libavcodec/dxa.c @@ -42,6 +42,7 @@ typedef struct DxaDecContext { AVFrame *prev; int dsize; +#define DECOMP_BUF_PADDING 16 uint8_t *decomp_buf; uint32_t pal[256]; } DxaDecContext; @@ -245,6 +246,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n"); return AVERROR_UNKNOWN; } + memset(c->decomp_buf + dsize, 0, DECOMP_BUF_PADDING); } if (avctx->debug & FF_DEBUG_PICT_INFO) @@ -328,7 +330,7 @@ static av_cold int decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_PAL8; c->dsize = avctx->width * avctx->height * 2; - c->decomp_buf = av_malloc(c->dsize); + c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING); if (!c->decomp_buf) { av_frame_free(&c->prev); av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n");