From bfcee368e28823b1289240ae061ccc8ee28cf33e Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Tue, 6 Aug 2024 19:47:49 +0200 Subject: [PATCH] avcodec/cbs_sei: Always zero-initialize SEI payload Fixes: Use-of-uninitialized value Fixes: clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5458626041413632 Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Rheinhardt --- libavcodec/cbs_sei.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libavcodec/cbs_sei.c b/libavcodec/cbs_sei.c index eefa07cf00..458751d92e 100644 --- a/libavcodec/cbs_sei.c +++ b/libavcodec/cbs_sei.c @@ -41,7 +41,6 @@ int ff_cbs_sei_alloc_message_payload(SEIRawMessage *message, const SEIMessageTypeDescriptor *desc) { void (*free_func)(FFRefStructOpaque, void*); - unsigned flags = 0; av_assert0(message->payload == NULL && message->payload_ref == NULL); @@ -53,10 +52,9 @@ int ff_cbs_sei_alloc_message_payload(SEIRawMessage *message, free_func = &cbs_free_user_data_unregistered; else { free_func = NULL; - flags = FF_REFSTRUCT_FLAG_NO_ZEROING; } - message->payload_ref = ff_refstruct_alloc_ext(desc->size, flags, + message->payload_ref = ff_refstruct_alloc_ext(desc->size, 0, NULL, free_func); if (!message->payload_ref) return AVERROR(ENOMEM);