diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-08 15:03:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-11 11:54:31 +0200 |
| commit | 9686fdd729a9caeeac0dc84dca2a65e4c9e5460b (patch) | |
| tree | fe88f8de09832a306e55e8f710f774229da597e5 | |
| parent | e29a99a975b722463c19d53f67e32f12f6dfe445 (diff) | |
| download | ffmpeg-9686fdd729a9caeeac0dc84dca2a65e4c9e5460b.tar.gz | |
avcodec/ilbcdec: Clear cbvec when used with create_augmented_vector()
Fixes: use of uninitialized memory
Fixes: 42538134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/ilbcdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c index a9dfa857a2..8b495a2f8e 100644 --- a/libavcodec/ilbcdec.c +++ b/libavcodec/ilbcdec.c @@ -675,6 +675,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector * /* get vector */ memcpy(cbvec, mem + lMem - k, cbveclen * 2); } else if (index < base_size) { + memset(cbvec, 0, cbveclen * 2); /* Calculate lag */ @@ -701,6 +702,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector * filter_mafq12(&mem[memIndTest + 4], cbvec, kCbFiltersRev, CB_FILTERLEN, cbveclen); } else { + memset(cbvec, 0, cbveclen * 2); /* interpolated vectors */ /* Stuff zeros outside memory buffer */ memIndTest = lMem - cbveclen - CB_FILTERLEN; |