PR #23895 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895.patch
Fixes: use of uninitialized memory Fixes: rscc_short_deflate_heap_disclosure.avi Fixes: plB80py3i3Bu Found-by: Adrian Junge (vurlo) >From a925117eb879160ea7c76a41cf520788775b3c8f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 22 Jul 2026 05:44:03 +0200 Subject: [PATCH] avcodec/rscc: reject deflate output shorter than the tile Fixes: use of uninitialized memory Fixes: rscc_short_deflate_heap_disclosure.avi Fixes: plB80py3i3Bu Found-by: Adrian Junge (vurlo) --- libavcodec/rscc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 3715e1c6d4..5fde30ec35 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame, ret = AVERROR_UNKNOWN; goto end; } + if (len < pixel_size) { + av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n", + len, pixel_size); + memset(ctx->inflated_buf + len, 0, pixel_size - len); + pixel_size = len; + } pixels = ctx->inflated_buf; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
