[FFmpeg-devel] [PR] avcodec/dca_xll: Clear padding in ff_dca_xll_parse() (PR #21525)

[FFmpeg-devel] [PR] avcodec/dca_xll: Clear padding in ff_dca_xll_parse() (PR #21525)

[michaelni via ffmpeg-devel]

PR #21525 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21525
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21525.patch

Fixes: Use of uninitialized memory
Fixes: 472020020/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_DEC_fuzzer-6433045331902464

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From d951ac1f2e9e1c4fe8d274b5ffa86abb8fd9c3df Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 19 Jan 2026 22:33:00 +0100
Subject: [PATCH] avcodec/dca_xll: Clear padding in ff_dca_xll_parse()

Fixes: Use of uninitialized memory
Fixes: 472020020/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_DEC_fuzzer-6433045331902464

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/dca_xll.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/dca_xll.c b/libavcodec/dca_xll.c
index 0e9a4e77e7..e1e444b7b9 100644
--- a/libavcodec/dca_xll.c
+++ b/libavcodec/dca_xll.c
@@ -1192,6 +1192,9 @@ int ff_dca_xll_parse(DCAXllDecoder *s, const uint8_t *data, DCAExssAsset *asset)
     else
         ret = parse_frame_no_pbr(s, data + asset->xll_offset, asset->xll_size, asset);
 
+    if (s->pbr_length)
+        memset(s->pbr_buffer + s->pbr_length, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
     return ret;
 }
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org