Paul B Mahol:
> On Thu, Jun 27, 2024 at 3:57 AM Kacper Michajłow <kaspe...@gmail.com> wrote:
>
>> Fixes use of uninitialized value, reported by MSAN. Specifically in
>> jpegxl parser.
>>
>> Found by OSS-Fuzz.
>>
>> Signed-off-by: Kacper Michajłow <kaspe...@gmail.com>
>> ---
>> libavformat/img2dec.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
>> index ba52353074..c667d8574c 100644
>> --- a/libavformat/img2dec.c
>> +++ b/libavformat/img2dec.c
>> @@ -549,6 +549,8 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket
>> *pkt)
>> }
>> }
>>
>> + memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>> +
>> if (ret[0] <= 0 || ret[1] < 0 || ret[2] < 0) {
>> if (ret[0] < 0) {
>> res = ret[0];
>> --
>> 2.43.0
>>
>>
> Isn't this done generically already?
> Otherwise this fix is just fixing one single case of numerous others not
> covered.
>
av_new_packet() is zeroing the padding, but in case that less is read
than intended the bytes after the payload bytes are uninitialized.
- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
