wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/shorten: Clear the additionally allocated space on realloc

Browse source 
Fixes: use of uninitialized memory
Fixes: 421954767/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-515682786246656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2025-07-23 21:13:33 +02:00
parent 1b7a327b3a
commit 909229b880
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 3 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
libavcodec/shorten.c
View file

@ -584,7 +584,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame,
if (avpkt->size) {
int max_framesize = s->blocksize * s->channels * 8;
void *tmp_ptr;
unsigned old_allocated_bitstream_size = s->allocated_bitstream_size;
tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,
max_framesize + AV_INPUT_BUFFER_PADDING_SIZE);
if (!tmp_ptr) {
@ -592,9 +592,8 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame,
return AVERROR(ENOMEM);
}
s->bitstream = tmp_ptr;
if (max_framesize > s->max_framesize)
memset(s->bitstream + s->max_framesize, 0, (max_framesize - s->max_framesize) +
AV_INPUT_BUFFER_PADDING_SIZE);
if (s->allocated_bitstream_size > old_allocated_bitstream_size)
memset(s->bitstream + old_allocated_bitstream_size, 0, s->allocated_bitstream_size - old_allocated_bitstream_size);
s->max_framesize = FFMAX(s->max_framesize, max_framesize);
*got_frame_ptr = 0;
goto finish_frame;