This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new a6e5d5ff99 avcodec/dxa: allocate the decompression buffer zeroed
a6e5d5ff99 is described below
commit a6e5d5ff993a525933d8d8f29071eb6c74b0436a
Author: Umar Pathan <[email protected]>
AuthorDate: Sat Sep 12 23:32:25 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Wed Sep 23 02:04:11 2026 +0000
avcodec/dxa: allocate the decompression buffer zeroed
Frame types 2 to 5 copy width * height bytes out of decomp_buf, and type 4
does so without inflating anything into it first, so with av_malloc the
first such frame could expose uninitialized memory.
Fixes: use of uninitialized memory
Fixes: poc.dxa
Fixes: VrmSMPNXh7JB
Found-by: Umar Pathan (Umar0x)
Signed-off-by: Umar Pathan <[email protected]>
---
libavcodec/dxa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c
index 39719bc575..c47f87dbb5 100644
--- a/libavcodec/dxa.c
+++ b/libavcodec/dxa.c
@@ -338,7 +338,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
avctx->pix_fmt = AV_PIX_FMT_PAL8;
c->dsize = avctx->width * avctx->height * 2;
- c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING);
+ c->decomp_buf = av_mallocz(c->dsize + DECOMP_BUF_PADDING);
if (!c->decomp_buf) {
av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n");
return AVERROR(ENOMEM);
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
