[FFmpeg-devel] [PATCH 1/4] avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation

[FFmpeg-devel] [PATCH 1/4] avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation

[Michael Niedermayer]

Fixes: use of uninitialized memory
Fixes: 378102648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5896308499480576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevc/hevcdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 21ecf063c5a..53aa8d60ff4 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -152,10 +152,10 @@ static int pic_arrays_init(HEVCLayerContext *l, const HEVCSPS *sps)
             int w = sps->width >> sps->hshift[c_idx];
             int h = sps->height >> sps->vshift[c_idx];
             l->sao_pixel_buffer_h[c_idx] =
-                av_malloc((w * 2 * sps->ctb_height) <<
+                av_mallocz((w * 2 * sps->ctb_height) <<
                           sps->pixel_shift);
             l->sao_pixel_buffer_v[c_idx] =
-                av_malloc((h * 2 * sps->ctb_width) <<
+                av_mallocz((h * 2 * sps->ctb_width) <<
                           sps->pixel_shift);
             if (!l->sao_pixel_buffer_h[c_idx] ||
                 !l->sao_pixel_buffer_v[c_idx])
-- 
2.50.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avformat/mov: make sure file_checksum is fully initialized

[Michael Niedermayer]

Fixes: use of uninitialized memory
Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index ccaa988e4be..8f1c5df3c96 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1407,7 +1407,9 @@ static int mov_read_adrm(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     avio_read(pb, output, 8); // go to offset 8, absolute position 0x251
     avio_read(pb, input, DRM_BLOB_SIZE);
     avio_read(pb, output, 4); // go to offset 4, absolute position 0x28d
-    avio_read(pb, file_checksum, 20);
+    ret = ffio_read_size(pb, file_checksum, 20);
+    if (ret < 0)
+        goto fail;
 
     // required by external tools
     ff_data_to_hex(checksum_string, file_checksum, sizeof(file_checksum), 1);
-- 
2.50.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Michael Niedermayer]

Fixes: read of uninitialized memory
Fixes: 391916474/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4935250956845056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mxfdec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 0eed13d850d..184e97256cd 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb)
         return AVERROR_INVALIDDATA;
 
     memcpy(klv->key, mxf_klv_key, 4);
-    avio_read(pb, klv->key + 4, 12);
+    int ret = ffio_read_size(pb, klv->key + 4, 12);
+    if (ret < 0)
+        return ret;
     length = klv_decode_ber_length(pb, &llen);
     if (length < 0)
         return length;
-- 
2.50.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avformat/vqf: Ensure that comm_chunk is fully read

[Michael Niedermayer]

Fixes: use of uninitialized memory
Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/vqf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index 053720ea22f..fb668c16da3 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -144,7 +144,9 @@ static int vqf_read_header(AVFormatContext *s)
             if (len < 12)
                 return AVERROR_INVALIDDATA;
 
-            avio_read(s->pb, comm_chunk, 12);
+            ret = ffio_read_size(s->pb, comm_chunk, 12);
+            if (ret < 0)
+                return ret;
             st->codecpar->ch_layout.nb_channels = AV_RB32(comm_chunk) + 1;
             read_bitrate        = AV_RB32(comm_chunk + 4);
             rate_flag           = AV_RB32(comm_chunk + 8);
-- 
2.50.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Tomas Härdin]

ons 2025-07-23 klockan 13:45 +0200 skrev Michael Niedermayer:
> Fixes: read of uninitialized memory
> Fixes: 391916474/clusterfuzz-testcase-minimized-
> ffmpeg_dem_MXF_fuzzer-4935250956845056
> 
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/mxfdec.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index 0eed13d850d..184e97256cd 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf,
> KLVPacket *klv, AVIOContext *pb)
>          return AVERROR_INVALIDDATA;
>  
>      memcpy(klv->key, mxf_klv_key, 4);
> -    avio_read(pb, klv->key + 4, 12);
> +    int ret = ffio_read_size(pb, klv->key + 4, 12);
> +    if (ret < 0)
> +        return ret;

ret != 12 is better. If it's non-negative then return AVERROR_EOF

/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Marton Balint]

On Wed, 23 Jul 2025, Tomas Härdin wrote:

> ons 2025-07-23 klockan 13:45 +0200 skrev Michael Niedermayer:
>> Fixes: read of uninitialized memory
>> Fixes: 391916474/clusterfuzz-testcase-minimized-
>> ffmpeg_dem_MXF_fuzzer-4935250956845056
>> 
>> Found-by: continuous fuzzing process
>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>> ---
>>  libavformat/mxfdec.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>> 
>> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
>> index 0eed13d850d..184e97256cd 100644
>> --- a/libavformat/mxfdec.c
>> +++ b/libavformat/mxfdec.c
>> @@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf,
>> KLVPacket *klv, AVIOContext *pb)
>>          return AVERROR_INVALIDDATA;
>>  
>>      memcpy(klv->key, mxf_klv_key, 4);
>> -    avio_read(pb, klv->key + 4, 12);
>> +    int ret = ffio_read_size(pb, klv->key + 4, 12);
>> +    if (ret < 0)
>> +        return ret;
>
> ret != 12 is better. If it's non-negative then return AVERROR_EOF

ffio_read_size always returns the requested size or negative.
Also AVERROR_EOF would be a valid file ending, but a truncated read 
clearly means AVERROR_INVALIDDATA, and that is exactly what 
ffio_read_size() returns on a short read. So the patch is correct as is 
IMHO.

Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Tomas Härdin]

tor 2025-07-24 klockan 00:51 +0200 skrev Marton Balint:
> 
> 
> On Wed, 23 Jul 2025, Tomas Härdin wrote:
> 
> > ons 2025-07-23 klockan 13:45 +0200 skrev Michael Niedermayer:
> > > Fixes: read of uninitialized memory
> > > Fixes: 391916474/clusterfuzz-testcase-minimized-
> > > ffmpeg_dem_MXF_fuzzer-4935250956845056
> > > 
> > > Found-by: continuous fuzzing process
> > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > ---
> > >  libavformat/mxfdec.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > > index 0eed13d850d..184e97256cd 100644
> > > --- a/libavformat/mxfdec.c
> > > +++ b/libavformat/mxfdec.c
> > > @@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf,
> > > KLVPacket *klv, AVIOContext *pb)
> > >          return AVERROR_INVALIDDATA;
> > >  
> > >      memcpy(klv->key, mxf_klv_key, 4);
> > > -    avio_read(pb, klv->key + 4, 12);
> > > +    int ret = ffio_read_size(pb, klv->key + 4, 12);
> > > +    if (ret < 0)
> > > +        return ret;
> > 
> > ret != 12 is better. If it's non-negative then return AVERROR_EOF
> 
> ffio_read_size always returns the requested size or negative.

Herp. Well in that case it's fine yes

/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Ensure klv->key is initialized

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1899 bytes --]

On Thu, Jul 24, 2025 at 08:25:35PM +0200, Tomas Härdin wrote:
> tor 2025-07-24 klockan 00:51 +0200 skrev Marton Balint:
> > 
> > 
> > On Wed, 23 Jul 2025, Tomas Härdin wrote:
> > 
> > > ons 2025-07-23 klockan 13:45 +0200 skrev Michael Niedermayer:
> > > > Fixes: read of uninitialized memory
> > > > Fixes: 391916474/clusterfuzz-testcase-minimized-
> > > > ffmpeg_dem_MXF_fuzzer-4935250956845056
> > > > 
> > > > Found-by: continuous fuzzing process
> > > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > > ---
> > > >  libavformat/mxfdec.c | 4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > > > index 0eed13d850d..184e97256cd 100644
> > > > --- a/libavformat/mxfdec.c
> > > > +++ b/libavformat/mxfdec.c
> > > > @@ -491,7 +491,9 @@ static int klv_read_packet(MXFContext *mxf,
> > > > KLVPacket *klv, AVIOContext *pb)
> > > >          return AVERROR_INVALIDDATA;
> > > >  
> > > >      memcpy(klv->key, mxf_klv_key, 4);
> > > > -    avio_read(pb, klv->key + 4, 12);
> > > > +    int ret = ffio_read_size(pb, klv->key + 4, 12);
> > > > +    if (ret < 0)
> > > > +        return ret;
> > > 
> > > ret != 12 is better. If it's non-negative then return AVERROR_EOF
> > 
> > ffio_read_size always returns the requested size or negative.
> 
> Herp. Well in that case it's fine yes

will apply patchset

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Any man who breaks a law that conscience tells him is unjust and willingly 
accepts the penalty by staying in jail in order to arouse the conscience of 
the community on the injustice of the law is at that moment expressing the 
very highest respect for law. - Martin Luther King Jr

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".