This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new cd1f545cf2 avcodec/rscc: do not leave uninitilized data when the input
is too short
cd1f545cf2 is described below
commit cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 05:44:03 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Wed Jul 29 21:20:49 2026 +0000
avcodec/rscc: do not leave uninitilized data when the input is too short
Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
---
libavcodec/rscc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
index 3715e1c6d4..5fde30ec35 100644
--- a/libavcodec/rscc.c
+++ b/libavcodec/rscc.c
@@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx,
AVFrame *frame,
ret = AVERROR_UNKNOWN;
goto end;
}
+ if (len < pixel_size) {
+ av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are
needed\n",
+ len, pixel_size);
+ memset(ctx->inflated_buf + len, 0, pixel_size - len);
+ pixel_size = len;
+ }
pixels = ctx->inflated_buf;
}
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
