avcodec/rscc: do not leave uninitilized data when the input is too short

Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
(cherry picked from commit cd1f545cf2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer committed 2026-09-19 14:27:00 +02:00
1 parent 46ef25c9c2
commit 57e01be3af
1 file changed
+6
+6
View File
@@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame,
ret = AVERROR_UNKNOWN;
goto end;
}
if (len < pixel_size) {
av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n",
len, pixel_size);
memset(ctx->inflated_buf + len, 0, pixel_size - len);
pixel_size = len;
}
pixels = ctx->inflated_buf;
}