diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-09 11:38:07 +0200 |
|---|---|---|
| committer | michaelni <michael@niedermayer.cc> | 2025-08-09 14:25:47 +0000 |
| commit | d6fe3786cd8c06437756d407f727ff01cf1774ff (patch) | |
| tree | 9e67dc3efaacdf005797f0b08bc95c5cc9f0d5cc | |
| parent | 6d9f0b662ff0bc91c30ebad7b821337e93539ed5 (diff) | |
| download | ffmpeg-d6fe3786cd8c06437756d407f727ff01cf1774ff.tar.gz | |
avcodec/jpeg2000dec: Make sure the 4 extra bytes allocated are initialized
Fixes: use of uninitialized memory
Fixes: 429130590/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5736930522497024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 59f3133d1f..221ba87305 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -1532,6 +1532,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile, bytestream2_get_bufferu(&s->g, cblk->data + cblk->length, cblk->lengthinc[cwsno]); cblk->length += cblk->lengthinc[cwsno]; + memset(cblk->data + cblk->length, 0, 4); cblk->lengthinc[cwsno] = 0; if (cblk->nb_terminationsinc) { cblk->nb_terminationsinc--; |