[FFmpeg-devel] [PR] avcodec/dxv: Clear tex_data padding on all reallocation (PR #21484)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21484 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21484
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21484.patch

The code previously cleared it on direct fast_realloc() but ff_lzf_uncompress() can also cause reallocation



>From 38c03957438de1636219de2a3c77379a7cd3d66f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Jan 2026 03:31:14 +0100
Subject: [PATCH 1/2] avcodec/lzf: Remove size messing from ff_lzf_uncompress()

size represents the output size
randomly changing it but not reseting it on errors leaks uninitialized memory.

Fixes: 475000819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5571269310611456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/lzf.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 8f223b1f42..5d6e9925d4 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -38,16 +38,15 @@
 #define LZF_LONG_BACKREF 7 + 2
 
 
-static inline int lzf_realloc(uint8_t **buf, size_t *size, int addition, unsigned *allocated_size)
+static inline int lzf_realloc(uint8_t **buf, size_t new_size, unsigned *allocated_size)
 {
-    void *ptr = av_fast_realloc(*buf, allocated_size, *size + addition);
+    void *ptr = av_fast_realloc(*buf, allocated_size, new_size);
 
     if (!ptr) {
         av_freep(buf); //probably not needed
         return AVERROR(ENOMEM);
     }
     *buf = ptr;
-    *size += addition;
 
     return 0;
 }
@@ -63,8 +62,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned
 
         if (s < LZF_LITERAL_MAX) {
             s++;
-            if (s > *size - len) {
-                ret = lzf_realloc(buf, size, s, allocated_size);
+            if (s > *allocated_size - len) {
+                ret = lzf_realloc(buf, len + s, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;
@@ -88,8 +87,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned
             if (off > len)
                 return AVERROR_INVALIDDATA;
 
-            if (l > *size - len) {
-                ret = lzf_realloc(buf, size, l, allocated_size);
+            if (l > *allocated_size - len) {
+                ret = lzf_realloc(buf, len + l, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;
-- 
2.52.0


>From 3f446b56e73b948aade4f0c400ca1eca176b7832 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Jan 2026 03:40:04 +0100
Subject: [PATCH 2/2] avcodec/dxv: Clear tex_data padding on reallocation

dxv assumes that newly reallocated memory in tex_data is not uninitialized
thus we have to do that too in case of reallocation in ff_lzf_uncompress()

Fixes: 475000819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5571269310611456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/dxv.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 07eee253e7..626dd75a33 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -828,7 +828,12 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx)
 static int dxv_decompress_lzf(AVCodecContext *avctx)
 {
     DXVContext *ctx = avctx->priv_data;
-    return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size);
+    unsigned old_size = ctx->tex_data_size;
+    int ret = ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size);
+    old_size = FFMAX(old_size, ctx->tex_size);
+    if (ctx->tex_data_size > old_size)
+        memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size);
+    return ret;
 }
 
 static int dxv_decompress_raw(AVCodecContext *avctx)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org