From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id EE4364C19C for ; Wed, 8 Oct 2025 21:20:18 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'6tWTv3JihYuHc/4heHDCH1mm4nEIgn04Wt9zIJVQeB0=', expected b'iXA2jVYdlgR4JKM8QTq254LwuonilxjW38TTXmyzB+o=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1759958410; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=6tWTv3JihYuHc/4heHDCH1mm4nEIgn04Wt9zIJVQeB0=; b=bmsc6wtG8mRQX7EFDQGf8gNukFpT6rUKb1acctwxmp3FY7BUYQPvDf9QqLELso3pPta4H J2pex2I5nq5gv1pZGNRzuDp2Lj1TxZMBCp8aomth88b2krSt6eDXHZaH6PFu9Vk21Cu0EoV VT7dwyKN7hnikKtgPu2eWjbvr7X9Q57NtwHcdmjU1cuZHy0V50MDEmCL9dU2af/fUxOxJVE jwIBcfShiHdR5GKNa2HQZNLJBn8W0it7IIT8pKihRr+xct1q2+b72cDNhZqxXZjarUf5NY5 01Eskiz6rCdH9AULqxBRleDOiU0qxWhF9LeW0HEwiRTK0Cs8DrQ3jlfTzdhw== Received: from [172.18.0.2] (unknown [172.19.0.4]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 6EAAC68F2F6; Thu, 9 Oct 2025 00:20:10 +0300 (EEST) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1759958389; b=ArmIGcgbi3tX9iWzqFVSDzjh8cz5U31Fj2rUtyO/qjA+dq7BRvofswU/aFG1qkVwmY2zf pNsCMSex0/x7PXUWm3grS/IhVEMa0Lm+l780fBe3aGe46orC9habAU55xjwfnt+F1lB0Ai6 Yy8pBhDMHzYz/jOCrf8yg/phJYpvI+cvGC7SLHkqmPhTwTPASbcw/KUPrQ94C3hzHPn7E0v sZOZDGU6FxFBYJT6IZBe+4QnmDrornF/u/Yh3p8Wm4GMDE5aV2dHOeeztBhCJtRSq8qKHJO w34Q7nlNcJuJ4xcZIjyksBX9vSGzosFIBiFlgRBf0DvlpRG0MUJO1sIPg4Mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1759958389; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=CSVjpdUcjwnJZfEHGosTXTHqOSc+h8hclf1Rv0rVqp0=; b=Ru2oV6WmY9q066AntTGS1kGzYw1pnHIuwtHJBDydXNGDfT8MuKplt96ktZ8hVG3eW8Crd ZtgMGhxwcbwiXovTaW6AclbVwQoK6b7CtNNUS4QKQXmAj78qgRvnLa0kM7vpw4C4gAB3mv+ Tvsfi3WkmyLsWiIVoN9VxDzomP0N8GqbcH/bZcVygr5FXx+Ths2yKPTG+Uwx6rWgThHzAIO Sg3DcpWloBshwlGbTsN/MmWYgou8tmfMe+jNSfgkep59mk1q3592fThtTM1q3+JSGuXmPla dajZQX2hbi0+4044a2p0YC6LaEtn1IMNmsQn6FRdgoItSLrxIlE7eR9kgtKA== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1759958382; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=iXA2jVYdlgR4JKM8QTq254LwuonilxjW38TTXmyzB+o=; b=A8Ls/qgj1PsUJA6YxVmvMYq4i0tr6ru5PacBbnep5hJ2YfqWxL0jb581EeJzVKwmECjhG Me+bDEP8InCVel4S2J3kq0cekDTOdEENgiBuUXC8KaFWvLGDeX9EFDIBLFEm+nfQYHA953J wMhQX2oNMisPbodEaMuO5fV50vLLmNK2orW0EI00iNtAOUuvY0Eg4Ji/88lFsVs1e+HyCKs 8qhZd0y7EUx9yX1zMi+09IEJNFAi6xvj0SHSfwjhaCbf+EEc3EHg+tDGNpIMSIOwkuIOd4E +/2gc+OnlC3KksjPMoxsUEnCMNFicuXMnEoFIzig4DdXOJNNIkqghQMYeGOg== Received: from be50bb5a3685 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 22E1568F15C for ; Thu, 9 Oct 2025 00:19:42 +0300 (EEST) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Wed, 08 Oct 2025 21:19:41 -0000 Message-ID: <175995838228.65.11428139635895875712@bf249f23a2c8> Message-ID-Hash: FYKKEW6ALTGC64SRFU7V2YESDDM7EC3G X-Message-ID-Hash: FYKKEW6ALTGC64SRFU7V2YESDDM7EC3G X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avcodec/vlc: Clear val8/16 in vlc_multi_gen() (PR #20673) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: michaelni via ffmpeg-devel Cc: michaelni Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #20673 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20673.patch Fixes: use of uninitialized memory Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689 Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632 the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should not be used, but on errors this data can remain ... Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer >>From 8150bca3d133f12193696e19da9c8dbb24c03a37 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 6 Aug 2025 12:49:49 +0200 Subject: [PATCH] avcodec/vlc: Clear val8/16 in vlc_multi_gen() Fixes: use of uninitialized memory Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689 Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632 the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should not be used, but on errors this data can remain ... Alternatively the whole table can be cleared on allocation (which is what i proposed previously in pr/20134) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vlc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c index 260b2052be..8d07ab8188 100644 --- a/libavcodec/vlc.c +++ b/libavcodec/vlc.c @@ -499,6 +499,7 @@ static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single, for (int j = 0; j < 1<table[j].len; table[j].num = single->table[j].len > 0 ? 1 : 0; + AV_ZERO64(table[j].val8); if (is16bit) table[j].val16[0] = single->table[j].sym; else -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org