diff mbox series

[FFmpeg-devel,3/8] avformat/img2dec: Clear padding data after EOF

Message ID 20240804205309.1978196-3-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/8] avcodec/apac: Clean padding space | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Aug. 4, 2024, 8:53 p.m. UTC
Fixes: use-of-uninitialized-value
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/img2dec.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Kacper Michajlow Aug. 5, 2024, 12:10 a.m. UTC | #1
On Sun, 4 Aug 2024 at 23:01, Michael Niedermayer <michael@niedermayer.cc> wrote:
>
> Fixes: use-of-uninitialized-value
> Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/img2dec.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
> index 20b1bc31f6a..3389fa818e9 100644
> --- a/libavformat/img2dec.c
> +++ b/libavformat/img2dec.c
> @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
>          }
>          goto fail;
>      } else {
> +        memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>          s->img_count++;
>          s->img_number++;
>          s->pts++;
> --
> 2.45.2

I've also had this one
(https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-3-kasper93@gmail.com/),
but probably it is better to do it only in the else branch here. So,
LGTM.

- Kacper
Michael Niedermayer Aug. 5, 2024, 7:40 p.m. UTC | #2
On Mon, Aug 05, 2024 at 02:10:18AM +0200, Kacper Michajlow wrote:
> On Sun, 4 Aug 2024 at 23:01, Michael Niedermayer <michael@niedermayer.cc> wrote:
> >
> > Fixes: use-of-uninitialized-value
> > Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
> >
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/img2dec.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
> > index 20b1bc31f6a..3389fa818e9 100644
> > --- a/libavformat/img2dec.c
> > +++ b/libavformat/img2dec.c
> > @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
> >          }
> >          goto fail;
> >      } else {
> > +        memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
> >          s->img_count++;
> >          s->img_number++;
> >          s->pts++;
> > --
> > 2.45.2
> 
> I've also had this one
> (https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-3-kasper93@gmail.com/),
> but probably it is better to do it only in the else branch here. So,

> LGTM.

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index 20b1bc31f6a..3389fa818e9 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -563,6 +563,7 @@  int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
         }
         goto fail;
     } else {
+        memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
         s->img_count++;
         s->img_number++;
         s->pts++;