[PR] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure (PR #23626)

PR #23626 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626.patch

Fixes: use of uninitialized memory
Fixes: CsNDKB1K1U0C
Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <[email protected]>



>From 4e5c0df681ef9284f55d91dc488d5a3a35d02405 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sun, 28 Jun 2026 19:04:07 +0200
Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap
 disclosure

Fixes: use of uninitialized memory
Fixes: CsNDKB1K1U0C
Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/lcldec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index 29b1d85be3..5023243017 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -120,6 +120,9 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign
         }
     }
 
+    if (destptr < destptr_end)
+        memset(destptr, 0, destptr_end - destptr);
+
     return destptr - destptr_bak;
 }
 
@@ -153,8 +156,11 @@ static int zlib_decomp(AVCodecContext *avctx, const uint8_t *src, int src_len, i
     if (expected != (unsigned int)zstream->total_out) {
         av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n",
                expected, zstream->total_out);
-        if (expected > (unsigned int)zstream->total_out)
+        if (expected > (unsigned int)zstream->total_out) {
+            memset(c->decomp_buf + offset + zstream->total_out, 0,
+                   c->decomp_size - offset - zstream->total_out);
             return (unsigned int)zstream->total_out;
+        }
         return AVERROR_UNKNOWN;
     }
     return zstream->total_out;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]