PR #24463 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24463 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24463.patch
Frame types 2 to 5 copy width * height bytes out of decomp_buf, and type 4 does so without inflating anything into it first, so with av_malloc the first such frame could expose uninitialized memory. Fixes: use of uninitialized memory Fixes: poc.dxa Fixes: VrmSMPNXh7JB Found-by: Umar Pathan (Umar0x) Signed-off-by: Umar Pathan <[email protected]> >From 47f43285a328bb7d27dfa10edc0bc4011467714f Mon Sep 17 00:00:00 2001 From: Umar Pathan <[email protected]> Date: Sat, 12 Sep 2026 23:32:25 +0200 Subject: [PATCH] avcodec/dxa: allocate the decompression buffer zeroed Frame types 2 to 5 copy width * height bytes out of decomp_buf, and type 4 does so without inflating anything into it first, so with av_malloc the first such frame could expose uninitialized memory. Fixes: use of uninitialized memory Fixes: poc.dxa Fixes: VrmSMPNXh7JB Found-by: Umar Pathan (Umar0x) Signed-off-by: Umar Pathan <[email protected]> --- libavcodec/dxa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c index 39719bc575..c47f87dbb5 100644 --- a/libavcodec/dxa.c +++ b/libavcodec/dxa.c @@ -338,7 +338,7 @@ static av_cold int decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_PAL8; c->dsize = avctx->width * avctx->height * 2; - c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING); + c->decomp_buf = av_mallocz(c->dsize + DECOMP_BUF_PADDING); if (!c->decomp_buf) { av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n"); return AVERROR(ENOMEM); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
