eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-11 17:30:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/dxv: Clear ctex

Browse Source 
same issue as with tex

Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e5f25c0a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-08-08 12:25:55 +02:00
parent 6049800a10
commit da3f5273fc
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/dxv.c
View File

@@ -39,6 +39,7 @@ typedef struct DXVContext {
uint8_t *tex_data; // Compressed texture
uint8_t *ctex_data; // Compressed chroma texture
unsigned ctex_data_size;
int64_t tex_size; // Texture size
int64_t ctex_size; // Chroma texture size
@@ -987,9 +988,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32;
ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16;
ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (ret < 0)
return ret;
old_size = ctx->ctex_data_size;
ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!ptr)
return AVERROR(ENOMEM);
ctx->ctex_data = ptr;
if (old_size < ctx->ctex_data_size)
memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
for (i = 0; i < 4; i++) {
ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
if (ret < 0)
@@ -1081,6 +1087,8 @@ static av_cold int dxv_close(AVCodecContext *avctx)
av_freep(&ctx->tex_data);
av_freep(&ctx->ctex_data);
ctx->ctex_data_size = 0;
av_freep(&ctx->op_data[0]);
av_freep(&ctx->op_data[1]);
av_freep(&ctx->op_data[2]);