projects / ffmpeg.git / commitdiff
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 2b37613)
avcodec/vlc: Clear val8/16 in vlc_multi_gen() by av_mallocz()
authorMichael Niedermayer <michael@niedermayer.cc>
Wed, 6 Aug 2025 10:49:49 +0000 (12:49 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 21 Nov 2025 19:56:59 +0000 (20:56 +0100)
Fixes: use of uninitialized memory
Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689
Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632

the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should
not be used, but on errors this data can remain ...

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8ffec5bf9a2803f55cc0822a97b7815f24bee83)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/vlc.c patch | blob | history

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 79eb8142e1f5143119e8a88242b18e132e550179..ecfaaf3c6639e642c4bf272ffccab78f9a71b03e 100644 (file)
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -456,7 +456,7 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
     if (ret < 0)
         return ret;
 
-    multi->table = av_malloc(sizeof(*multi->table) << nb_bits);
+    multi->table = av_mallocz(sizeof(*multi->table) << nb_bits);
     if (!multi->table)
         goto fail;
 
FFmpeg git repo