same issue as with tex Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680 Fixes: use of uninitialized memory
Unified · Split
| @@ -39,6 +39,7 @@ typedef struct DXVContext { · 38 unmodified lines | |||
| 39 | 39 | ||
| 40 | uint8_t *tex_data; // Compressed texture | 40 | uint8_t *tex_data; // Compressed texture |
| 41 | uint8_t *ctex_data; // Compressed chroma texture | 41 | uint8_t *ctex_data; // Compressed chroma texture |
| 42 | unsigned ctex_data_size; | ||
| 42 | 43 | ||
| 43 | int64_t tex_size; // Texture size | 44 | int64_t tex_size; // Texture size |
| 44 | int64_t ctex_size; // Chroma texture size | 45 | int64_t ctex_size; // Chroma texture size |
| @@ -987,9 +988,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame, · 942 unmodified lines | |||
| 987 | ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32; | 988 | ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32; |
| 988 | ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16; | 989 | ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16; |
| 989 | 990 | ||
| 990 | ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); | 991 | old_size = ctx->ctex_data_size; |
| 991 | if (ret < 0) | 992 | ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); |
| 992 | return ret; | 993 | if (!ptr) |
| 994 | return AVERROR(ENOMEM); | ||
| 995 | ctx->ctex_data = ptr; | ||
| 996 | if (old_size < ctx->ctex_data_size) | ||
| 997 | memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size); | ||
| 998 | |||
| 993 | for (i = 0; i < 4; i++) { | 999 | for (i = 0; i < 4; i++) { |
| 994 | ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]); | 1000 | ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]); |
| 995 | if (ret < 0) | 1001 | if (ret < 0) |
| @@ -1081,6 +1087,8 @@ static av_cold int dxv_close(AVCodecContext *avctx) · 85 unmodified lines | |||
| 1081 | 1087 | ||
| 1082 | av_freep(&ctx->tex_data); | 1088 | av_freep(&ctx->tex_data); |
| 1083 | av_freep(&ctx->ctex_data); | 1089 | av_freep(&ctx->ctex_data); |
| 1090 | ctx->ctex_data_size = 0; | ||
| 1091 | |||
| 1084 | av_freep(&ctx->op_data[0]); | 1092 | av_freep(&ctx->op_data[0]); |
| 1085 | av_freep(&ctx->op_data[1]); | 1093 | av_freep(&ctx->op_data[1]); |
| 1086 | av_freep(&ctx->op_data[2]); | 1094 | av_freep(&ctx->op_data[2]); |