Fixes: use of uninitialized value Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/cbs_vp9.c | 9 ++++++--- libavcodec/cbs_vp9.h | 3 +++ libavcodec/cbs_vp9_syntax_template.c | 6 +++--- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c index 816d06da04d..7b8bc9c7985 100644 --- a/libavcodec/cbs_vp9.c +++ b/libavcodec/cbs_vp9.c @@ -541,9 +541,12 @@ static int cbs_vp9_assemble_fragment(CodedBitstreamContext *ctx, size_len = av_log2(max) / 8 + 1; av_assert0(size_len <= 4); - sfi.superframe_marker = VP9_SUPERFRAME_MARKER; - sfi.bytes_per_framesize_minus_1 = size_len - 1; - sfi.frames_in_superframe_minus_1 = frag->nb_units - 1; + sfi.superframe_marker = + sfi.superframe_marker_2 = VP9_SUPERFRAME_MARKER; + sfi.bytes_per_framesize_minus_1 = + sfi.bytes_per_framesize_minus_1_2= size_len - 1; + sfi.frames_in_superframe_minus_1 = + sfi.frames_in_superframe_minus_1_2 = frag->nb_units - 1; size = 2; for (i = 0; i < frag->nb_units; i++) { diff --git a/libavcodec/cbs_vp9.h b/libavcodec/cbs_vp9.h index af15eb4bace..428662a8cdb 100644 --- a/libavcodec/cbs_vp9.h +++ b/libavcodec/cbs_vp9.h @@ -174,6 +174,9 @@ typedef struct VP9RawSuperframeIndex { uint8_t bytes_per_framesize_minus_1; uint8_t frames_in_superframe_minus_1; uint32_t frame_sizes[VP9_MAX_FRAMES_IN_SUPERFRAME]; + uint8_t superframe_marker_2; + uint8_t bytes_per_framesize_minus_1_2; + uint8_t frames_in_superframe_minus_1_2; } VP9RawSuperframeIndex; typedef struct VP9RawSuperframe { diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c index 2f08eccf180..3f542d0c5d5 100644 --- a/libavcodec/cbs_vp9_syntax_template.c +++ b/libavcodec/cbs_vp9_syntax_template.c @@ -421,9 +421,9 @@ static int FUNC(superframe_index)(CodedBitstreamContext *ctx, RWContext *rw, frame_sizes[i], 1, i); } - f(3, superframe_marker); - f(2, bytes_per_framesize_minus_1); - f(3, frames_in_superframe_minus_1); + f(3, superframe_marker_2); + f(2, bytes_per_framesize_minus_1_2); + f(3, frames_in_superframe_minus_1_2); return 0; } -- 2.45.2 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
