mirrors/ffmpeg
0
0 Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 10:04:37 +08:00
Code Activity

avcodec/dxa: allocate the decompression buffer zeroed

Browse Source 
Frame types 2 to 5 copy width * height bytes out of decomp_buf, and type 4
does so without inflating anything into it first, so with av_malloc the
first such frame could expose uninitialized memory.

Fixes: use of uninitialized memory
Fixes: poc.dxa
Fixes: VrmSMPNXh7JB
Found-by: Umar Pathan (Umar0x)
Signed-off-by: Umar Pathan <hello@umar.ac>
This commit is contained in:
Umar Pathan authored and michaelni committed 2026-09-23 02:04:11 +00:00
1 parent d26c080999
commit a6e5d5ff99
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/dxa.c
+1 -1
View File
@@ -338,7 +338,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
avctx->pix_fmt = AV_PIX_FMT_PAL8;
c->dsize = avctx->width * avctx->height * 2;
c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING);
c->decomp_buf = av_mallocz(c->dsize + DECOMP_BUF_PADDING);
if (!c->decomp_buf) {
av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n");
return AVERROR(ENOMEM);