[FFmpeg-devel] [PATCH] libavcodec/utils: Ensure allocated buffer is zero-initialized

[FFmpeg-devel] [PATCH] libavcodec/utils: Ensure allocated buffer is zero-initialized

[xjdeng]

In `av_fast_padded_mallocz`, the allocated buffer's zero-initialization is not guaranteed.
This is because it calls `av_fast_malloc`, which in turn calls `fast_malloc` with `zero_realloc=0`.
Consequently, the memory returned by the underlying `av_malloc` (used within `fast_malloc`)
is not guaranteed to be zero-initialized.

Furthermore, if `*size` is adjusted to be greater than `min_size + AV_INPUT_BUFFER_PADDING_SIZE`,
the subsequent `memset` operation will not cover the entire allocated buffer,
leaving a portion of it uninitialized.

To ensure the entire allocated buffer is properly zero-initialized, we should use `FFMAX`
to adjust the `memset` range.

Signed-off-by: xjdeng <micro6947@gmail.com>

---
 libavcodec/utils.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index f2686b6863..e2afce71ef 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -72,8 +72,8 @@ void av_fast_padded_mallocz(void *ptr, unsigned int *size, size_t min_size)
         return;
     }
     av_fast_malloc(p, size, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
-    if (*p)
-        memset(*p, 0, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
+    if (*p) 
+        memset(*p, 0, FFMAX(*size, min_size + AV_INPUT_BUFFER_PADDING_SIZE));
 }
 
 int av_codec_is_encoder(const AVCodec *avcodec)
-- 
2.27.0.windows.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] libavcodec/utils: Ensure allocated buffer is zero-initialized

[Zhao Zhili]

> On Jun 26, 2025, at 12:07, xjdeng <micro6947-at-gmail.com@ffmpeg.org> wrote:
> 
> In `av_fast_padded_mallocz`, the allocated buffer's zero-initialization is not guaranteed.
> This is because it calls `av_fast_malloc`, which in turn calls `fast_malloc` with `zero_realloc=0`.
> Consequently, the memory returned by the underlying `av_malloc` (used within `fast_malloc`)
> is not guaranteed to be zero-initialized.
> 
> Furthermore, if `*size` is adjusted to be greater than `min_size + AV_INPUT_BUFFER_PADDING_SIZE`,
> the subsequent `memset` operation will not cover the entire allocated buffer,
> leaving a portion of it uninitialized.
> 
> To ensure the entire allocated buffer is properly zero-initialized, we should use `FFMAX`
> to adjust the `memset` range.

I think memset size is enough. size >= min_size + AV_INPUT_BUFFER_PADDING_SIZE.

> 
> Signed-off-by: xjdeng <micro6947@gmail.com>
> 
> ---
> libavcodec/utils.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> index f2686b6863..e2afce71ef 100644
> --- a/libavcodec/utils.c
> +++ b/libavcodec/utils.c
> @@ -72,8 +72,8 @@ void av_fast_padded_mallocz(void *ptr, unsigned int *size, size_t min_size)
>         return;
>     }
>     av_fast_malloc(p, size, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> -    if (*p)
> -        memset(*p, 0, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> +    if (*p) 
> +        memset(*p, 0, FFMAX(*size, min_size + AV_INPUT_BUFFER_PADDING_SIZE));
> }
> 
> int av_codec_is_encoder(const AVCodec *avcodec)
> -- 
> 2.27.0.windows.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] libavcodec/utils: Ensure allocated buffer is zero-initialized

[Kacper Michajlow]

n Thu, 26 Jun 2025 at 16:07, Zhao Zhili
<quinkblack-at-foxmail.com@ffmpeg.org> wrote:
>
>
>
> > On Jun 26, 2025, at 12:07, xjdeng <micro6947-at-gmail.com@ffmpeg.org> wrote:
> >
> > In `av_fast_padded_mallocz`, the allocated buffer's zero-initialization is not guaranteed.
> > This is because it calls `av_fast_malloc`, which in turn calls `fast_malloc` with `zero_realloc=0`.
> > Consequently, the memory returned by the underlying `av_malloc` (used within `fast_malloc`)
> > is not guaranteed to be zero-initialized.
> >
> > Furthermore, if `*size` is adjusted to be greater than `min_size + AV_INPUT_BUFFER_PADDING_SIZE`,
> > the subsequent `memset` operation will not cover the entire allocated buffer,
> > leaving a portion of it uninitialized.
> >
> > To ensure the entire allocated buffer is properly zero-initialized, we should use `FFMAX`
> > to adjust the `memset` range.
>
> I think memset size is enough. size >= min_size + AV_INPUT_BUFFER_PADDING_SIZE.
>
> >
> > Signed-off-by: xjdeng <micro6947@gmail.com>
> >
> > ---
> > libavcodec/utils.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> > index f2686b6863..e2afce71ef 100644
> > --- a/libavcodec/utils.c
> > +++ b/libavcodec/utils.c
> > @@ -72,8 +72,8 @@ void av_fast_padded_mallocz(void *ptr, unsigned int *size, size_t min_size)
> >         return;
> >     }
> >     av_fast_malloc(p, size, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> > -    if (*p)
> > -        memset(*p, 0, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> > +    if (*p)
> > +        memset(*p, 0, FFMAX(*size, min_size + AV_INPUT_BUFFER_PADDING_SIZE));
> > }

I think the current code is intentional. In av_fast_malloc() and
siblings the `*size` is the real allocation size, but your working
area that you should be using is `
min_size` and hence why this area (+padding) is zeroed. You shouldn't
be using anything beyond that, as it is allocated space, but "not
active" right now.

These functions are meant to be `fast` by not reallocating when there
is enough space for user payload, and part of the `fast` part is also
not zeroing the memory area that you as a user don't request in
`min_size` parameter.

- Kacper
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] libavcodec/utils: Ensure allocated buffer is zero-initialized

[Xingjing Deng]

 Thank you very much — I think you've convinced me. This was my first time
asking a question in the FFmpeg community, and my limited understanding of
the code led to a false positive. I apologize for the delayed response, and
I truly appreciate your time and help.

Kacper Michajlow <kasper93@gmail.com> 于2025年6月27日周五 02:16写道：

> n Thu, 26 Jun 2025 at 16:07, Zhao Zhili
> <quinkblack-at-foxmail.com@ffmpeg.org> wrote:
> >
> >
> >
> > > On Jun 26, 2025, at 12:07, xjdeng <micro6947-at-gmail.com@ffmpeg.org>
> wrote:
> > >
> > > In `av_fast_padded_mallocz`, the allocated buffer's
> zero-initialization is not guaranteed.
> > > This is because it calls `av_fast_malloc`, which in turn calls
> `fast_malloc` with `zero_realloc=0`.
> > > Consequently, the memory returned by the underlying `av_malloc` (used
> within `fast_malloc`)
> > > is not guaranteed to be zero-initialized.
> > >
> > > Furthermore, if `*size` is adjusted to be greater than `min_size +
> AV_INPUT_BUFFER_PADDING_SIZE`,
> > > the subsequent `memset` operation will not cover the entire allocated
> buffer,
> > > leaving a portion of it uninitialized.
> > >
> > > To ensure the entire allocated buffer is properly zero-initialized, we
> should use `FFMAX`
> > > to adjust the `memset` range.
> >
> > I think memset size is enough. size >= min_size +
> AV_INPUT_BUFFER_PADDING_SIZE.
> >
> > >
> > > Signed-off-by: xjdeng <micro6947@gmail.com>
> > >
> > > ---
> > > libavcodec/utils.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> > > index f2686b6863..e2afce71ef 100644
> > > --- a/libavcodec/utils.c
> > > +++ b/libavcodec/utils.c
> > > @@ -72,8 +72,8 @@ void av_fast_padded_mallocz(void *ptr, unsigned int
> *size, size_t min_size)
> > >         return;
> > >     }
> > >     av_fast_malloc(p, size, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> > > -    if (*p)
> > > -        memset(*p, 0, min_size + AV_INPUT_BUFFER_PADDING_SIZE);
> > > +    if (*p)
> > > +        memset(*p, 0, FFMAX(*size, min_size +
> AV_INPUT_BUFFER_PADDING_SIZE));
> > > }
>
> I think the current code is intentional. In av_fast_malloc() and
> siblings the `*size` is the real allocation size, but your working
> area that you should be using is `
> min_size` and hence why this area (+padding) is zeroed. You shouldn't
> be using anything beyond that, as it is allocated space, but "not
> active" right now.
>
> These functions are meant to be `fast` by not reallocating when there
> is enough space for user payload, and part of the `fast` part is also
> not zeroing the memory area that you as a user don't request in
> `min_size` parameter.
>
> - Kacper
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".