PR #24869 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869.patch
The decode_plane_bitstream() cases were found during triage of the security report kqvngdpsCPjK Fixes: use of uninitialized memory Fixes: kqvngdpsCPjK Regression since: f6577bd9cf (decode_bgr_1()) Found-by: Adrian Junge (vurlo) Replicated through UnModified FFmpeg >From fb44c2b681c522f37957b45226ece4d1cfca052b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 4 Oct 2026 01:25:29 +0200 Subject: [PATCH] avcodec/huffyuvdec: zero the rest of a row the input ends in The decode_plane_bitstream() cases were found during triage of the security report kqvngdpsCPjK Fixes: use of uninitialized memory Fixes: kqvngdpsCPjK Regression since: f6577bd9cf (decode_bgr_1()) Found-by: Adrian Junge (vurlo) Replicated through UnModified FFmpeg --- libavcodec/huffyuvdec.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c index 39959c1c8b..78bd3d99b3 100644 --- a/libavcodec/huffyuvdec.c +++ b/libavcodec/huffyuvdec.c @@ -721,6 +721,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) { READ_2PIX_PLANE(s->temp[0][2 * i], s->temp[0][2 * i + 1], plane, OP8bits); } + memset(s->temp[0] + 2 * i, 0, 2 * (count - i)); } else { for(i=0; i<count; i++){ READ_2PIX_PLANE(s->temp[0][2 * i], s->temp[0][2 * i + 1], plane, OP8bits); @@ -733,7 +734,8 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) index = SHOW_UBITS(re, &s->gb, VLC_BITS); VLC_INTERN(s->temp[0][width-1], s->vlc[plane].table, &s->gb, re, VLC_BITS, 3); - } + } else if (width & 1) + s->temp[0][width - 1] = 0; CLOSE_READER(re, &s->gb); } else if (s->bps <= 14) { OPEN_READER(re, &s->gb); @@ -741,6 +743,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) { READ_2PIX_PLANE(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane, OP14bits); } + memset(s->temp16[0] + 2 * i, 0, 4 * (count - i)); } else { for(i=0; i<count; i++){ READ_2PIX_PLANE(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane, OP14bits); @@ -753,13 +756,15 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) index = SHOW_UBITS(re, &s->gb, VLC_BITS); VLC_INTERN(s->temp16[0][width-1], s->vlc[plane].table, &s->gb, re, VLC_BITS, 3); - } + } else if (width & 1) + s->temp16[0][width - 1] = 0; CLOSE_READER(re, &s->gb); } else { if (count >= (get_bits_left(&s->gb)) / (32 * 2)) { for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) { READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane); } + memset(s->temp16[0] + 2 * i, 0, 4 * (count - i)); } else { for(i=0; i<count; i++){ READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane); @@ -768,7 +773,8 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) if( width&1 && get_bits_left(&s->gb)>0 ) { int dst = (unsigned)get_vlc2(&s->gb, s->vlc[plane].table, VLC_BITS, 3)<<2; s->temp16[0][width-1] = dst + get_bits(&s->gb, 2); - } + } else if (width & 1) + s->temp16[0][width - 1] = 0; } } @@ -848,6 +854,7 @@ static av_always_inline void decode_bgr_1(HYuvDecContext *s, int count, s->temp[0][4 * i + A] = 0; } CLOSE_READER(re, &s->gb); + memset(s->temp[0] + 4 * i, 0, 4 * (count - i)); } static void decode_bgr_bitstream(HYuvDecContext *s, int count) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
