[PR] avcodec/lcldec: decompress the second multithread chunk into the rest of the frame (PR #24103)

PR #24103 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24103
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24103.patch

Fixes: read of uninitialized memory
Fixes: zTrrhikJHTRR
Found-by: Eunsoo Kim, Microsoft FORGE Labs



>From 29fd0a03c84fb07edceb39e68d924f7158c29d86 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 12 Aug 2026 03:12:07 +0200
Subject: [PATCH] avcodec/lcldec: decompress the second multithread chunk into
 the rest of the frame

Fixes: read of uninitialized memory
Fixes: zTrrhikJHTRR
Found-by: Eunsoo Kim, Microsoft FORGE Labs
---
 libavcodec/lcldec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index 5023243017..b8280ba7c6 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -290,7 +290,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
             ret = zlib_decomp(avctx, buf + 8, mthread_inlen, 0, mthread_outlen);
             if (ret < 0) return ret;
             ret = zlib_decomp(avctx, buf + 8 + mthread_inlen, len - 8 - mthread_inlen,
-                              mthread_outlen, mthread_outlen);
+                              mthread_outlen, c->decomp_size - mthread_outlen);
             if (ret < 0) return ret;
             len = c->decomp_size;
         } else {
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]