On Thu, 27 Jun 2024 at 02:55, Andreas Rheinhardt
<andreas.rheinha...@outlook.com> wrote:
>
> Kacper Michajłow:
> > Fixes use of uninitialized value, reported by MSAN.
> >
> > Found by OSS-Fuzz.
> >
> > Signed-off-by: Kacper Michajłow <kaspe...@gmail.com>
> > ---
> > libavcodec/jpegxl_parser.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
> > index 8c45e1a1b7..f833f844c4 100644
> > --- a/libavcodec/jpegxl_parser.c
> > +++ b/libavcodec/jpegxl_parser.c
> > @@ -1419,6 +1419,7 @@ static int try_parse(AVCodecParserContext *s,
> > AVCodecContext *avctx, JXLParseCon
> > }
> > cs_buffer = ctx->cs_buffer;
> > cs_buflen = FFMIN(sizeof(ctx->cs_buffer) -
> > AV_INPUT_BUFFER_PADDING_SIZE, ctx->copied);
> > + memset(ctx->cs_buffer + cs_buflen, 0,
> > AV_INPUT_BUFFER_PADDING_SIZE);
> > } else {
> > cs_buffer = buf;
> > cs_buflen = buf_size;
>
> This is very strange: The buffer here is part of the parser's private
> context and this is zeroed initially. So it should never contain
> uninitialized values.
You are right, but reading this code I had the feeling that it would
have the same issue, we read only ctx->copied amount of bytes. We can
skip this one if this is certain that this buffer will be clear before
reuse always.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
