diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 17:14:59 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 17:16:01 +0100 |
| commit | f6c95f4f8c2f592c14239baf11a47b42170830e6 (patch) | |
| tree | 452ee6ef201f86243e7fd8f81f2ef1c440ed65dd /libavcodec/dxa.c | |
| parent | a33c7dd21362a694692d0dc30fdbffae5a5d837e (diff) | |
| download | ffmpeg-f6c95f4f8c2f592c14239baf11a47b42170830e6.tar.gz | |
avcodec/dxa: add padding to decomp_buf
Fixes use of uninitialized memory
Fixes part of msan_uninit-mem_7f5ea8284fb7_8317_scummvm.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dxa.c')
| -rw-r--r-- | libavcodec/dxa.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c index 1d96f10ef4..e6750e95bd 100644 --- a/libavcodec/dxa.c +++ b/libavcodec/dxa.c @@ -42,6 +42,7 @@ typedef struct DxaDecContext { AVFrame *prev; int dsize; +#define DECOMP_BUF_PADDING 16 uint8_t *decomp_buf; uint32_t pal[256]; } DxaDecContext; @@ -245,6 +246,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n"); return AVERROR_UNKNOWN; } + memset(c->decomp_buf + dsize, 0, DECOMP_BUF_PADDING); } if (avctx->debug & FF_DEBUG_PICT_INFO) @@ -328,7 +330,7 @@ static av_cold int decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_PAL8; c->dsize = avctx->width * avctx->height * 2; - c->decomp_buf = av_malloc(c->dsize); + c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING); if (!c->decomp_buf) { av_frame_free(&c->prev); av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n"); |