same issue as with tex Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680 Fixes: use of uninitialized memory
Unified · Split
| @@ -39,6 +39,7 @@ typedef struct DXVContext { · 38 unmodified lines | ||
| 39 | 39 | |
| 40 | 40 | uint8_t *tex_data; // Compressed texture |
| 41 | 41 | uint8_t *ctex_data; // Compressed chroma texture |
| 42 | + unsigned ctex_data_size; | |
| 42 | 43 | |
| 43 | 44 | int64_t tex_size; // Texture size |
| 44 | 45 | int64_t ctex_size; // Chroma texture size |
| @@ -987,9 +988,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame, · 942 unmodified lines | ||
| 987 | 988 | ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32; |
| 988 | 989 | ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16; |
| 989 | 990 | |
| 990 | − ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); | |
| 991 | − if (ret < 0) | |
| 992 | − return ret; | |
| 991 | + old_size = ctx->ctex_data_size; | |
| 992 | + ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); | |
| 993 | + if (!ptr) | |
| 994 | + return AVERROR(ENOMEM); | |
| 995 | + ctx->ctex_data = ptr; | |
| 996 | + if (old_size < ctx->ctex_data_size) | |
| 997 | + memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size); | |
| 998 | + | |
| 993 | 999 | for (i = 0; i < 4; i++) { |
| 994 | 1000 | ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]); |
| 995 | 1001 | if (ret < 0) |
| @@ -1081,6 +1087,8 @@ static av_cold int dxv_close(AVCodecContext *avctx) · 85 unmodified lines | ||
| 1081 | 1087 | |
| 1082 | 1088 | av_freep(&ctx->tex_data); |
| 1083 | 1089 | av_freep(&ctx->ctex_data); |
| 1090 | + ctx->ctex_data_size = 0; | |
| 1091 | + | |
| 1084 | 1092 | av_freep(&ctx->op_data[0]); |
| 1085 | 1093 | av_freep(&ctx->op_data[1]); |
| 1086 | 1094 | av_freep(&ctx->op_data[2]); |