pu_info is read uninitialized on damaged input and at that point the following codepath is dependant on the uninitialized data. In one of these pathes out of array accesses happen. None of this is replicatable Less uninitialized data also should result in more reproducable reports Fixes: Use of uninitialized memory Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5103986067963904
Unified · Split
| @@ -308,6 +308,8 @@ static int update_dimensions_clear_info(RV60Context *s, int width, int height) · 307 unmodified lines | ||
| 308 | 308 | if ((ret = av_reallocp_array(&s->blk_info, s->blk_stride * (s->cu_height << 4), sizeof(s->blk_info[0]))) < 0) |
| 309 | 309 | return ret; |
| 310 | 310 | |
| 311 | + memset(s->pu_info, 0, s->pu_stride * (s->cu_height << 3) * sizeof(s->pu_info[0])); | |
| 312 | + | |
| 311 | 313 | for (int j = 0; j < s->cu_height << 4; j++) |
| 312 | 314 | for (int i = 0; i < s->cu_width << 4; i++) |
| 313 | 315 | s->blk_info[j*s->blk_stride + i].mv.mvref = MVREF_NONE; |