[FFmpeg-devel] [PR] avformat/segafilm: dont read uninitialized value (PR #21680)

[FFmpeg-devel] [PR] avformat/segafilm: dont read uninitialized value (PR #21680)

[michaelni via ffmpeg-devel]

PR #21680 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21680
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21680.patch

scratch[20] doesnt exist in version 0

Fixes: use of uninitialized memory
Fixes: 471664627/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-4738726971637760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


>From c736716a57c776b7b802c141c3c75a3e5158d866 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 8 Feb 2026 00:28:04 +0100
Subject: [PATCH] avformat/segafilm: dont read uninitialized value

scratch[20] doesnt exist in version 0

Fixes: use of uninitialized memory
Fixes: 471664627/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-4738726971637760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
 libavformat/segafilm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/segafilm.c b/libavformat/segafilm.c
index 2b853017db..e0ea1da31e 100644
--- a/libavformat/segafilm.c
+++ b/libavformat/segafilm.c
@@ -163,7 +163,7 @@ static int film_read_header(AVFormatContext *s)
         st->codecpar->height = AV_RB32(&scratch[12]);
 
         if (film->video_type == AV_CODEC_ID_RAWVIDEO) {
-            if (scratch[20] == 24) {
+            if (film->version == 0 || scratch[20] == 24) {
                 st->codecpar->format = AV_PIX_FMT_RGB24;
             } else {
                 av_log(s, AV_LOG_ERROR, "raw video is using unhandled %dbpp\n", scratch[20]);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org