(the exact issue is unreproducable but the use of uninitialized data is reproducable) Should fix: signed integer overflow: -2147483648 - 127 cannot be represented in type 'int' Should fix: 69881/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-4751301204836352
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -2110,8 +2110,8 @@ static av_cold int decode_init(AVCodecContext *avctx) · 2109 unmodified lines | ||
| 2110 | 2110 | |
| 2111 | 2111 | if (sconf->floating) { |
| 2112 | 2112 | ctx->acf = av_malloc_array(channels, sizeof(*ctx->acf)); |
| 2113 | − ctx->shift_value = av_malloc_array(channels, sizeof(*ctx->shift_value)); | |
| 2114 | − ctx->last_shift_value = av_malloc_array(channels, sizeof(*ctx->last_shift_value)); | |
| 2113 | + ctx->shift_value = av_calloc(channels, sizeof(*ctx->shift_value)); | |
| 2114 | + ctx->last_shift_value = av_calloc(channels, sizeof(*ctx->last_shift_value)); | |
| 2115 | 2115 | ctx->last_acf_mantissa = av_malloc_array(channels, sizeof(*ctx->last_acf_mantissa)); |
| 2116 | 2116 | ctx->raw_mantissa = av_calloc(channels, sizeof(*ctx->raw_mantissa)); |
| 2117 | 2117 | |