[FFmpeg-devel] [PATCH] avcodec/vlc: Clear val8/16 in vlc_multi_gen() (PR #20673)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20673 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673.patch

Fixes: use of uninitialized memory
Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689
Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632

the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should
not be used, but on errors this data can remain ...

Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 8150bca3d133f12193696e19da9c8dbb24c03a37 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 12:49:49 +0200
Subject: [PATCH] avcodec/vlc: Clear val8/16 in vlc_multi_gen()

Fixes: use of uninitialized memory
Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689
Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632

the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should
not be used, but on errors this data can remain ...

Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vlc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 260b2052be..8d07ab8188 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -499,6 +499,7 @@ static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single,
     for (int j = 0; j < 1<<numbits; j++) {
         table[j].len = single->table[j].len;
         table[j].num = single->table[j].len > 0 ? 1 : 0;
+        AV_ZERO64(table[j].val8);
         if (is16bit)
             table[j].val16[0] = single->table[j].sym;
         else
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org