| Message ID | 20240804205309.1978196-3-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/8] avcodec/apac: Clean padding space | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Sun, 4 Aug 2024 at 23:01, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Fixes: use-of-uninitialized-value > Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/img2dec.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c > index 20b1bc31f6a..3389fa818e9 100644 > --- a/libavformat/img2dec.c > +++ b/libavformat/img2dec.c > @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) > } > goto fail; > } else { > + memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); > s->img_count++; > s->img_number++; > s->pts++; > -- > 2.45.2 I've also had this one (https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-3-kasper93@gmail.com/), but probably it is better to do it only in the else branch here. So, LGTM. - Kacper
On Mon, Aug 05, 2024 at 02:10:18AM +0200, Kacper Michajlow wrote: > On Sun, 4 Aug 2024 at 23:01, Michael Niedermayer <michael@niedermayer.cc> wrote: > > > > Fixes: use-of-uninitialized-value > > Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/img2dec.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c > > index 20b1bc31f6a..3389fa818e9 100644 > > --- a/libavformat/img2dec.c > > +++ b/libavformat/img2dec.c > > @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) > > } > > goto fail; > > } else { > > + memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); > > s->img_count++; > > s->img_number++; > > s->pts++; > > -- > > 2.45.2 > > I've also had this one > (https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-3-kasper93@gmail.com/), > but probably it is better to do it only in the else branch here. So, > LGTM. will apply thx [...]
diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 20b1bc31f6a..3389fa818e9 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } goto fail; } else { + memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); s->img_count++; s->img_number++; s->pts++;
Fixes: use-of-uninitialized-value Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/img2dec.c | 1 + 1 file changed, 1 insertion(+)