diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-08 12:25:55 +0200 |
|---|---|---|
| committer | michaelni <michael@niedermayer.cc> | 2025-08-13 10:12:07 +0000 |
| commit | 6a8c41dcacbba011e553fbf35518577321d1aadb (patch) | |
| tree | 1eb010f6dbb1bb85eb783c8b2800f2fb2ad7174c | |
| parent | 4a0b793737ec1a118d2119a677fa17926def01bc (diff) | |
| download | ffmpeg-6a8c41dcacbba011e553fbf35518577321d1aadb.tar.gz | |
avcodec/dxv: Check that we initialize op_data
Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dxv.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index 7e11bef733..9bef92d7b2 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -275,7 +275,9 @@ static int dxv_decompress_opcodes(GetByteContext *gb, void *dstp, size_t op_size if ((flag & 3) == 0) { bytestream2_skip(gb, 1); - bytestream2_get_buffer(gb, dstp, op_size); + int read_size = bytestream2_get_buffer(gb, dstp, op_size); + if (read_size != op_size) + return AVERROR_INVALIDDATA; } else if ((flag & 3) == 1) { bytestream2_skip(gb, 1); memset(dstp, bytestream2_get_byte(gb), op_size); |