This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 22 05:44:03 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:30 2026 +0200 avcodec/rscc: do not leave uninitilized data when the input is too short Fixes: use of uninitialized memory Fixes: rscc_short_deflate_heap_disclosure.avi Fixes: plB80py3i3Bu Found-by: Adrian Junge (vurlo) (cherry picked from commit cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/rscc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 3715e1c6d4..5fde30ec35 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame, ret = AVERROR_UNKNOWN; goto end; } + if (len < pixel_size) { + av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n", + len, pixel_size); + memset(ctx->inflated_buf + len, 0, pixel_size - len); + pixel_size = len; + } pixels = ctx->inflated_buf; } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
