PR #25716 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716.patch
>From 1a027c248183f13e577061b1c793edc55e7d8598 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:31:08 +0100 Subject: [PATCH 1/2] avcodec/cscd: allocate the decompression buffer zeroed Short payloads are accepted since d2a0464fc2 and ab7d38f970. Fixes: use of uninitialized memory Fixes: Eivz8cYLGnrh Fixes: AISLE-2026-0150-00238, AISLE-2026-0150-00058 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers (AISLE) --- libavcodec/cscd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cscd.c b/libavcodec/cscd.c index e552b0a14f7..6b3c0b13464 100644 --- a/libavcodec/cscd.c +++ b/libavcodec/cscd.c @@ -149,7 +149,7 @@ static av_cold int decode_init(AVCodecContext *avctx) c->height = avctx->height; stride = FFALIGN(c->linelen, 4); c->decomp_size = c->height * stride; - c->decomp_buf = av_malloc(c->decomp_size + AV_LZO_OUTPUT_PADDING); + c->decomp_buf = av_mallocz(c->decomp_size + AV_LZO_OUTPUT_PADDING); if (!c->decomp_buf) { av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n"); return AVERROR(ENOMEM); -- 2.54.0 >From 4d95c95ab23a289104f6c9b11604e3a172c50eb9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:31:08 +0100 Subject: [PATCH 2/2] avcodec/vmnc: restore the screen under the cursor only after it was painted Fixes: use of uninitialized memory Fixes: t1Iyw4k7bw8h Fixes: AISLE-2026-0150-00465 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers (AISLE) --- libavcodec/vmnc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/vmnc.c b/libavcodec/vmnc.c index 162e8ee9bb7..b3946f96b19 100644 --- a/libavcodec/vmnc.c +++ b/libavcodec/vmnc.c @@ -71,6 +71,7 @@ typedef struct VmncContext { int cur_hx, cur_hy; uint8_t *curbits, *curmask; uint8_t *screendta; + int cursor_painted; } VmncContext; /* read pixel value from stream */ @@ -345,7 +346,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, c->pic->pict_type = AV_PICTURE_TYPE_P; // restore screen after cursor - if (c->screendta) { + if (c->cursor_painted) { int i; w = c->cur_w; if (c->width < c->cur_x + w) @@ -371,6 +372,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, outptr += c->pic->linesize[0]; } } + c->cursor_painted = 0; } while (chunks--) { @@ -513,6 +515,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, } outptr = c->pic->data[0]; put_cursor(outptr, c->pic->linesize[0], c, c->cur_x, c->cur_y); + c->cursor_painted = 1; } } *got_frame = 1; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
