PR #20872 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20872 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20872.patch
Fixes: use of uninitialized memory Fixes: 439878388/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5635866203848704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 2a1a04c4b0cbe64a534d05ea1a321e6175f5bb2c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 8 Nov 2025 23:22:56 +0100 Subject: [PATCH] avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il() Fixes: use of uninitialized memory Fixes: 439878388/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5635866203848704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/utvideodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index bc02ac44d5..098706b705 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -457,7 +457,7 @@ static void restore_median_planar_il(UtvideoContext *c, uint8_t *src, ptrdiff_t // second line - first element has top prediction, the rest uses median C = bsrc[-stride2]; bsrc[0] += C; - A = bsrc[0]; + A = B = bsrc[0]; for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */ B = bsrc[i - stride2]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
