mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-10-28 18:15:24 +08:00
avcodec/rscc: do not leave uninitilized data when the input is too short
Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
(cherry picked from commit cd1f545cf2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
1 file changed
+6
@@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame,
|
||||
ret = AVERROR_UNKNOWN;
|
||||
goto end;
|
||||
}
|
||||
if (len < pixel_size) {
|
||||
av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n",
|
||||
len, pixel_size);
|
||||
memset(ctx->inflated_buf + len, 0, pixel_size - len);
|
||||
pixel_size = len;
|
||||
}
|
||||
pixels = ctx->inflated_buf;
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user