[FFmpeg-devel] [PATCH] FFV1 / utvideo / magicyuv uninitilaized memory use (PR #20134)

[FFmpeg-devel] [PATCH] FFV1 / utvideo / magicyuv uninitilaized memory use (PR #20134)

[michaelni]

PR #20134 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20134
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20134.patch


From 74eb5aad285ed8174c70248153fca84f0b4f2248 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 12:49:49 +0200
Subject: [PATCH 1/3] avcodec/vlc: Clear table in
 ff_vlc_init_multi_from_lengths()

Fixes: use of uninitialized memory
Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vlc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 260b2052be..93d88714f2 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -527,7 +527,7 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
     if (ret < 0)
         return ret;
 
-    multi->table = av_malloc(sizeof(*multi->table) << nb_bits);
+    multi->table = av_mallocz(sizeof(*multi->table) << nb_bits);
     if (!multi->table)
         goto fail;
 
-- 
2.49.1


From 42a291b7945d890cd2ca91de5ea88b6a592e05a8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 13:09:26 +0200
Subject: [PATCH 2/3] avcodec/utvideodec: Set B for the width= 1 case

Fixes: use of uninitialized meory
Fixes: 428034093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-6195630160805888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/utvideodec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index 4c0fa2ca67..934945c1be 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -402,7 +402,7 @@ static void restore_median_planar(UtvideoContext *c, uint8_t *src, ptrdiff_t str
         // second line - first element has top prediction, the rest uses median
         C        = bsrc[-stride];
         bsrc[0] += C;
-        A        = bsrc[0];
+        A = B    = bsrc[0];
         for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */
             B        = bsrc[i - stride];
             bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C));
-- 
2.49.1


From 8af386ccc58dfcc11714d0f112e6d079b05b9fec Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 13:36:06 +0200
Subject: [PATCH 3/3] avcodec/ffv1: Clear state on alloc

Fixes: use of uninitialized memory
Fixes: 428969823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-5909681623334912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ffv1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index 885cef265f..812989a892 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -79,7 +79,7 @@ av_cold int ff_ffv1_init_slice_state(const FFV1Context *f,
 
         if (f->ac != AC_GOLOMB_RICE) {
             if (!p->state)
-                p->state = av_malloc_array(p->context_count, CONTEXT_SIZE *
+                p->state = av_calloc(p->context_count, CONTEXT_SIZE *
                                      sizeof(uint8_t));
             if (!p->state)
                 return AVERROR(ENOMEM);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".