PR #20673 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673.patch
Fixes: use of uninitialized memory Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689 Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632 the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should not be used, but on errors this data can remain ... Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 8150bca3d133f12193696e19da9c8dbb24c03a37 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 6 Aug 2025 12:49:49 +0200 Subject: [PATCH] avcodec/vlc: Clear val8/16 in vlc_multi_gen() Fixes: use of uninitialized memory Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689 Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632 the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should not be used, but on errors this data can remain ... Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/vlc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c index 260b2052be..8d07ab8188 100644 --- a/libavcodec/vlc.c +++ b/libavcodec/vlc.c @@ -499,6 +499,7 @@ static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single, for (int j = 0; j < 1<<numbits; j++) { table[j].len = single->table[j].len; table[j].num = single->table[j].len > 0 ? 1 : 0; + AV_ZERO64(table[j].val8); if (is16bit) table[j].val16[0] = single->table[j].sym; else -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
