PR #22505 opened by Kenaz123 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22505 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22505.patch
Fix #22420. Zero-initialize y_buffer in the XAN WC4 decoder. When the first decoded frame is type 1, `xan_decode_frame_type1()` reads from y_buffer before writing it. Since the buffer was allocated with `av_malloc()`, this could incorporate uninitialized heap data into the decoded luma output. Allocate it with `av_mallocz()` instead. >From aee4201960db020d3c16727639a40a6c97c46d50 Mon Sep 17 00:00:00 2001 From: Weidong Wang <[email protected]> Date: Sat, 14 Mar 2026 13:45:39 -0500 Subject: [PATCH] avcodec/xxan: zero-initialize y_buffer --- libavcodec/xxan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c index cb6a97c668..60d2c40075 100644 --- a/libavcodec/xxan.c +++ b/libavcodec/xxan.c @@ -68,7 +68,7 @@ static av_cold int xan_decode_init(AVCodecContext *avctx) } s->buffer_size = avctx->width * avctx->height; - s->y_buffer = av_malloc(s->buffer_size); + s->y_buffer = av_mallocz(s->buffer_size); if (!s->y_buffer) return AVERROR(ENOMEM); s->scratch_buffer = av_malloc(s->buffer_size + 130); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
