[FFmpeg-devel] [PATCH 4/6] avformat/wtvdec: clear sectors

[Peter Ross]

On Wed, Aug 07, 2024 at 12:18:51AM +0200, Michael Niedermayer wrote:
> The code can leave uninitialized holes in the array.
> Fixes: use of uninitialized values
> Fixes: 70883/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6698694567591936
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/wtvdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
> index e153034aa19..1a6c4c33481 100644
> --- a/libavformat/wtvdec.c
> +++ b/libavformat/wtvdec.c
> @@ -185,7 +185,7 @@ static AVIOContext * wtvfile_open_sector(unsigned first_sector, uint64_t length,
>          int nb_sectors1 = read_ints(s->pb, sectors1, WTV_SECTOR_SIZE / 4);
>          int i;
>  
> -        wf->sectors = av_malloc_array(nb_sectors1, 1 << WTV_SECTOR_BITS);
> +        wf->sectors = av_calloc(nb_sectors1, 1 << WTV_SECTOR_BITS);
>          if (!wf->sectors) {
>              av_free(wf);
>              return NULL;

agree, please apply

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240807/bb192415/attachment.sig>