PR #24877 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877.patch
The RLE case was found during triage of the security report Yf3lKVRHj1Sr, the zeroing in the frame was added then as hardening Fixes: use of uninitialized memory Fixes: Yf3lKVRHj1Sr Regression since: ceb0dd9f1e Found-by: Adrian Junge (vurlo) >From 5b0ce388dfc1505d9c1a9a8360bb5b8ef602d034 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 4 Oct 2026 03:56:21 +0200 Subject: [PATCH] avcodec/sunrast: zero the rest of the raster the input ends in The RLE case was found during triage of the security report Yf3lKVRHj1Sr, the zeroing in the frame was added then as hardening Fixes: use of uninitialized memory Fixes: Yf3lKVRHj1Sr Regression since: ceb0dd9f1e Found-by: Adrian Junge (vurlo) --- libavcodec/sunrast.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c index cc27838f5b..1cd51f4637 100644 --- a/libavcodec/sunrast.c +++ b/libavcodec/sunrast.c @@ -156,11 +156,11 @@ static int sunrast_decode_frame(AVCodecContext *avctx, AVFrame *p, stride = p->linesize[0]; } + uint8_t *end = ptr + (ptrdiff_t)h * stride; + x = 0; if (type == RT_BYTE_ENCODED) { int value, run; - uint8_t *end = ptr + (ptrdiff_t)h * stride; - x = 0; while (ptr != end && buf < buf_end) { run = 1; if (buf_end - buf < 1) { @@ -193,6 +193,8 @@ static int sunrast_decode_frame(AVCodecContext *avctx, AVFrame *p, buf += alen; } } + for (; ptr != end; ptr += stride, x = 0) + memset(ptr + x, 0, len - x); if (avctx->pix_fmt == AV_PIX_FMT_PAL8 && depth < 8) { uint8_t *ptr_free = ptr2; ptr = p->data[0]; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
