[FFmpeg-devel] [PATCH] avcodec/vvc/dec: Always clear tab in tl_create() (PR #20670)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20670 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20670
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20670.patch

Fixes: use of uninitialized memory
Fixes: 449549597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5600497089445888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From b8be9468dc6fb2baa880c45c2e89ab04d056c1c8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 8 Oct 2025 17:21:31 +0200
Subject: [PATCH] avcodec/vvc/dec: Always clear tab in tl_create()

Fixes: use of uninitialized memory
Fixes: 449549597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5600497089445888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vvc/dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
index b31fceef40..9b738b8a44 100644
--- a/libavcodec/vvc/dec.c
+++ b/libavcodec/vvc/dec.c
@@ -86,7 +86,7 @@ static int tl_create(TabList *l)
 
         for (int i = 0; i < l->nb_tabs; i++) {
             Tab *t = l->tabs + i;
-            *t->tab = l->zero ? av_mallocz(t->size) : av_malloc(t->size);
+            *t->tab = av_mallocz(t->size);
             if (!*t->tab)
                 return AVERROR(ENOMEM);
         }
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org