PR #21484 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21484 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21484.patch
The code previously cleared it on direct fast_realloc() but ff_lzf_uncompress() can also cause reallocation >From 38c03957438de1636219de2a3c77379a7cd3d66f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 16 Jan 2026 03:31:14 +0100 Subject: [PATCH 1/2] avcodec/lzf: Remove size messing from ff_lzf_uncompress() size represents the output size randomly changing it but not reseting it on errors leaks uninitialized memory. Fixes: 475000819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5571269310611456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lzf.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c index 8f223b1f42..5d6e9925d4 100644 --- a/libavcodec/lzf.c +++ b/libavcodec/lzf.c @@ -38,16 +38,15 @@ #define LZF_LONG_BACKREF 7 + 2 -static inline int lzf_realloc(uint8_t **buf, size_t *size, int addition, unsigned *allocated_size) +static inline int lzf_realloc(uint8_t **buf, size_t new_size, unsigned *allocated_size) { - void *ptr = av_fast_realloc(*buf, allocated_size, *size + addition); + void *ptr = av_fast_realloc(*buf, allocated_size, new_size); if (!ptr) { av_freep(buf); //probably not needed return AVERROR(ENOMEM); } *buf = ptr; - *size += addition; return 0; } @@ -63,8 +62,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (s < LZF_LITERAL_MAX) { s++; - if (s > *size - len) { - ret = lzf_realloc(buf, size, s, allocated_size); + if (s > *allocated_size - len) { + ret = lzf_realloc(buf, len + s, allocated_size); if (ret < 0) return ret; p = *buf + len; @@ -88,8 +87,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (off > len) return AVERROR_INVALIDDATA; - if (l > *size - len) { - ret = lzf_realloc(buf, size, l, allocated_size); + if (l > *allocated_size - len) { + ret = lzf_realloc(buf, len + l, allocated_size); if (ret < 0) return ret; p = *buf + len; -- 2.52.0 >From 3f446b56e73b948aade4f0c400ca1eca176b7832 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 16 Jan 2026 03:40:04 +0100 Subject: [PATCH 2/2] avcodec/dxv: Clear tex_data padding on reallocation dxv assumes that newly reallocated memory in tex_data is not uninitialized thus we have to do that too in case of reallocation in ff_lzf_uncompress() Fixes: 475000819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5571269310611456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/dxv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index 07eee253e7..626dd75a33 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -828,7 +828,12 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx) static int dxv_decompress_lzf(AVCodecContext *avctx) { DXVContext *ctx = avctx->priv_data; - return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size); + unsigned old_size = ctx->tex_data_size; + int ret = ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size); + old_size = FFMAX(old_size, ctx->tex_size); + if (ctx->tex_data_size > old_size) + memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size); + return ret; } static int dxv_decompress_raw(AVCodecContext *avctx) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
