PR #22934 opened by Zhao Zhili (quink) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22934 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22934.patch
Several _alloc() functions taking a size_t *size output parameter either left it uninitialized or unconditionally set it to sizeof(...) when the underlying av_mallocz() failed. Callers that check the returned pointer first are unaffected, but the stale value is a trap for any code path that inspects size without a NULL check. Signed-off-by: Zhao Zhili <[email protected]> >From 73ed0411ad3cfed76e4de21f35b986d670527fef Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Mon, 27 Apr 2026 15:53:21 +0800 Subject: [PATCH] avutil: zero size output parameter on allocation failure Several _alloc() functions taking a size_t *size output parameter either left it uninitialized or unconditionally set it to sizeof(...) when the underlying av_mallocz() failed. Callers that check the returned pointer first are unaffected, but the stale value is a trap for any code path that inspects size without a NULL check. Signed-off-by: Zhao Zhili <[email protected]> --- libavutil/ambient_viewing_environment.c | 7 ++++--- libavutil/dovi_meta.c | 13 ++++++------- libavutil/film_grain_params.c | 2 +- libavutil/hdr_dynamic_metadata.c | 8 ++------ libavutil/hdr_dynamic_vivid_metadata.c | 4 +--- libavutil/mastering_display_metadata.c | 9 +++++---- libavutil/spherical.c | 7 ++++--- libavutil/stereo3d.c | 7 ++++--- 8 files changed, 27 insertions(+), 30 deletions(-) diff --git a/libavutil/ambient_viewing_environment.c b/libavutil/ambient_viewing_environment.c index e359727776..1715359f57 100644 --- a/libavutil/ambient_viewing_environment.c +++ b/libavutil/ambient_viewing_environment.c @@ -32,14 +32,15 @@ AVAmbientViewingEnvironment *av_ambient_viewing_environment_alloc(size_t *size) { AVAmbientViewingEnvironment *env = av_mallocz(sizeof(AVAmbientViewingEnvironment)); + + if (size) + *size = env ? sizeof(*env) : 0; + if (!env) return NULL; get_defaults(env); - if (size) - *size = sizeof(*env); - return env; } diff --git a/libavutil/dovi_meta.c b/libavutil/dovi_meta.c index dfa4a438ed..048367665e 100644 --- a/libavutil/dovi_meta.c +++ b/libavutil/dovi_meta.c @@ -27,11 +27,9 @@ AVDOVIDecoderConfigurationRecord *av_dovi_alloc(size_t *size) { AVDOVIDecoderConfigurationRecord *dovi = av_mallocz(sizeof(AVDOVIDecoderConfigurationRecord)); - if (!dovi) - return NULL; - if (size) - *size = sizeof(*dovi); + if (size) + *size = dovi ? sizeof(*dovi) : 0; return dovi; } @@ -47,11 +45,12 @@ typedef struct AVDOVIMetadataInternal { AVDOVIMetadata *av_dovi_metadata_alloc(size_t *size) { AVDOVIMetadataInternal *dovi = av_mallocz(sizeof(AVDOVIMetadataInternal)); - if (!dovi) - return NULL; if (size) - *size = sizeof(*dovi); + *size = dovi ? sizeof(*dovi) : 0; + + if (!dovi) + return NULL; dovi->metadata = (struct AVDOVIMetadata) { .header_offset = offsetof(AVDOVIMetadataInternal, header), diff --git a/libavutil/film_grain_params.c b/libavutil/film_grain_params.c index 0a6004b6b3..cf63dcc4a6 100644 --- a/libavutil/film_grain_params.c +++ b/libavutil/film_grain_params.c @@ -25,7 +25,7 @@ AVFilmGrainParams *av_film_grain_params_alloc(size_t *size) AVFilmGrainParams *params = av_mallocz(sizeof(AVFilmGrainParams)); if (size) - *size = sizeof(*params); + *size = params ? sizeof(*params) : 0; return params; } diff --git a/libavutil/hdr_dynamic_metadata.c b/libavutil/hdr_dynamic_metadata.c index 5b8f3ea87d..f54f4fbda1 100644 --- a/libavutil/hdr_dynamic_metadata.c +++ b/libavutil/hdr_dynamic_metadata.c @@ -36,11 +36,9 @@ static const int32_t saturation_weight_den = 8; AVDynamicHDRPlus *av_dynamic_hdr_plus_alloc(size_t *size) { AVDynamicHDRPlus *hdr_plus = av_mallocz(sizeof(AVDynamicHDRPlus)); - if (!hdr_plus) - return NULL; if (size) - *size = sizeof(*hdr_plus); + *size = hdr_plus ? sizeof(*hdr_plus) : 0; return hdr_plus; } @@ -399,11 +397,9 @@ int av_dynamic_hdr_plus_to_t35(const AVDynamicHDRPlus *s, uint8_t **data, size_t AVDynamicHDRSmpte2094App5 *av_dynamic_hdr_smpte2094_app5_alloc(size_t *size) { AVDynamicHDRSmpte2094App5 *smpte2094_app5 = av_mallocz(sizeof(AVDynamicHDRSmpte2094App5)); - if (!smpte2094_app5) - return NULL; if (size) - *size = sizeof(*smpte2094_app5); + *size = smpte2094_app5 ? sizeof(*smpte2094_app5) : 0; return smpte2094_app5; } diff --git a/libavutil/hdr_dynamic_vivid_metadata.c b/libavutil/hdr_dynamic_vivid_metadata.c index 32da01f587..630ea9492a 100644 --- a/libavutil/hdr_dynamic_vivid_metadata.c +++ b/libavutil/hdr_dynamic_vivid_metadata.c @@ -24,11 +24,9 @@ AVDynamicHDRVivid *av_dynamic_hdr_vivid_alloc(size_t *size) { AVDynamicHDRVivid *hdr_vivid = av_mallocz(sizeof(AVDynamicHDRVivid)); - if (!hdr_vivid) - return NULL; if (size) - *size = sizeof(*hdr_vivid); + *size = hdr_vivid ? sizeof(*hdr_vivid) : 0; return hdr_vivid; } diff --git a/libavutil/mastering_display_metadata.c b/libavutil/mastering_display_metadata.c index dd37ed7d0e..c4272a499c 100644 --- a/libavutil/mastering_display_metadata.c +++ b/libavutil/mastering_display_metadata.c @@ -44,14 +44,15 @@ AVMasteringDisplayMetadata *av_mastering_display_metadata_alloc(void) AVMasteringDisplayMetadata *av_mastering_display_metadata_alloc_size(size_t *size) { AVMasteringDisplayMetadata *mastering = av_mallocz(sizeof(AVMasteringDisplayMetadata)); + + if (size) + *size = mastering ? sizeof(*mastering) : 0; + if (!mastering) return NULL; get_defaults(mastering); - if (size) - *size = sizeof(*mastering); - return mastering; } @@ -74,7 +75,7 @@ AVContentLightMetadata *av_content_light_metadata_alloc(size_t *size) AVContentLightMetadata *metadata = av_mallocz(sizeof(AVContentLightMetadata)); if (size) - *size = sizeof(*metadata); + *size = metadata ? sizeof(*metadata) : 0; return metadata; } diff --git a/libavutil/spherical.c b/libavutil/spherical.c index 71342faea9..646e76b186 100644 --- a/libavutil/spherical.c +++ b/libavutil/spherical.c @@ -26,14 +26,15 @@ AVSphericalMapping *av_spherical_alloc(size_t *size) { AVSphericalMapping *spherical = av_mallocz(sizeof(AVSphericalMapping)); + + if (size) + *size = spherical ? sizeof(*spherical) : 0; + if (!spherical) return NULL; spherical->projection = AV_SPHERICAL_RECTILINEAR; - if (size) - *size = sizeof(*spherical); - return spherical; } diff --git a/libavutil/stereo3d.c b/libavutil/stereo3d.c index bf3d1e1fe5..561784bc7b 100644 --- a/libavutil/stereo3d.c +++ b/libavutil/stereo3d.c @@ -39,14 +39,15 @@ AVStereo3D *av_stereo3d_alloc(void) AVStereo3D *av_stereo3d_alloc_size(size_t *size) { AVStereo3D *stereo = av_mallocz(sizeof(AVStereo3D)); + + if (size) + *size = stereo ? sizeof(*stereo) : 0; + if (!stereo) return NULL; get_defaults(stereo); - if (size) - *size = sizeof(*stereo); - return stereo; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
