PR #25634 opened by Marti2203 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25634 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25634.patch
Follow-up to #25504, from a pre-existing issue noted in the Forgejo_Fairy review there. `decode_mous()` grows the cursor buffer with `av_fast_padded_malloc()` before inflating the new cursor. Growing the buffer zeroes it, so when `decode_zlib()` then fails (e.g. a bad zlib checksum), the zeroed buffer stays installed with the old cursor dimensions and the cursor disappears from every later frame. With a three-packet test file (an 8x1 cursor, then a 16x2 MOUS chunk with a broken checksum, then an MPOS-only packet), frame 3 on master is `0x2973e1d1` (no cursor), while frame 1 is `0x83dddb6d`. With this patch, frame 3 is `0x83dddb6d` again, the same as frame 1. The patch allocates the buffer only after the new data has been inflated. If the allocation itself fails, the old cursor is still lost, since `av_fast_padded_malloc()` frees the old buffer first, but `draw_cursor()` checks for a NULL cursor. This is independent of #25504 and applies to master as is. This issue was found during an LLM review (Forgejo_Fairy, #25504); the fix was verified manually. 🤖 Generated with [Claude Code](https://claude.com/claude-code) From e4571c89d7233ed4a4d65a60be62ee12d74836ce Mon Sep 17 00:00:00 2001 From: Martin Mirchev <[email protected]> Date: Sat, 31 Oct 2026 13:46:03 +0800 Subject: [PATCH] avcodec/rasc: keep the previous cursor if a MOUS chunk fails to decode decode_mous() grew the cursor buffer before inflating the new cursor. Growing it zeroes the buffer, and if decode_zlib() then failed, the zeroed buffer was kept with the old cursor dimensions. Later frames then drew no cursor at all. Allocate the buffer only after the new cursor data has been inflated. Signed-off-by: Martin Mirchev <[email protected]> --- libavcodec/rasc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c index d784a440633..9f284349a1c 100644 --- a/libavcodec/rasc.c +++ b/libavcodec/rasc.c @@ -569,15 +569,15 @@ static int decode_mous(AVCodecContext *avctx, if (uncompressed_size != 3 * w * h) return AVERROR_INVALIDDATA; - av_fast_padded_malloc(&s->cursor, &s->cursor_size, uncompressed_size); - if (!s->cursor) - return AVERROR(ENOMEM); - ret = decode_zlib(avctx, avpkt, size - (bytestream2_tell(gb) - pos), uncompressed_size); if (ret < 0) return ret; + + av_fast_padded_malloc(&s->cursor, &s->cursor_size, uncompressed_size); + if (!s->cursor) + return AVERROR(ENOMEM); memcpy(s->cursor, s->delta, uncompressed_size); bytestream2_skip(gb, size - (bytestream2_tell(gb) - pos)); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
