diff options
| author | Kacper Michajłow <kasper93@gmail.com> | 2024-06-27 02:40:37 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-05 23:17:46 +0200 |
| commit | 2b5f000d3f6f9e737e918a5438e6c881f65e70e2 (patch) | |
| tree | b47f2b63f66b99dc55aca4d5696853559e592a39 | |
| parent | 3978e81809a3daf278199849f7bbeacbffb9fa09 (diff) | |
| download | ffmpeg-2b5f000d3f6f9e737e918a5438e6c881f65e70e2.tar.gz | |
avformat/jpegxl_anim_dec: ensure input padding is zeroed
Fixes use of uninitialized value, reported by MSAN.
Found by OSS-Fuzz.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Fixes: 70837/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5089407768526848
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/jpegxl_anim_dec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c index ac95d3b961..2338a2e8c0 100644 --- a/libavformat/jpegxl_anim_dec.c +++ b/libavformat/jpegxl_anim_dec.c @@ -124,6 +124,8 @@ static int jpegxl_anim_read_header(AVFormatContext *s) } } + memset(head + headsize, 0, AV_INPUT_BUFFER_PADDING_SIZE); + /* offset in bits of the animation header */ ret = ff_jpegxl_parse_codestream_header(head, headsize, &meta, 0); if (ret < 0 || meta.animation_offset <= 0) |