ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-16 19:43:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/vc1dec: Clear mb_type_base and ttblk_base

Browse Source 
Fixes: two use-of-uninitialized-value
Fixes: 70856/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5539349918187520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-08-04 22:15:08 +02:00
parent e44349ee88
commit 50471f96c4
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/vc1dec.c
View File

@ -379,7 +379,7 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v)
if (!v->block || !v->cbp_base)
return AVERROR(ENOMEM);
v->cbp = v->cbp_base + 2 * s->mb_stride;
v->ttblk_base = av_malloc(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride);
v->ttblk_base = av_mallocz(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride);
if (!v->ttblk_base)
return AVERROR(ENOMEM);
v->ttblk = v->ttblk_base + 2 * s->mb_stride;
@ -393,7 +393,7 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v)
v->luma_mv = v->luma_mv_base + 2 * s->mb_stride;
/* allocate block type info in that way so it could be used with s->block_index[] */
v->mb_type_base = av_malloc(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2);
v->mb_type_base = av_mallocz(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2);
if (!v->mb_type_base)
return AVERROR(ENOMEM);
v->mb_type[0] = v->mb_type_base + s->b8_stride + 1;