[FFmpeg-devel] [PATCH 3/4] avformat/img2dec: ensure input padding is zeroed

[Andreas Rheinhardt]

Paul B Mahol:
> On Thu, Jun 27, 2024 at 3:57 AM Kacper Michajłow <kasper93 at gmail.com> wrote:
> 
>> Fixes use of uninitialized value, reported by MSAN. Specifically in
>> jpegxl parser.
>>
>> Found by OSS-Fuzz.
>>
>> Signed-off-by: Kacper Michajłow <kasper93 at gmail.com>
>> ---
>>  libavformat/img2dec.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
>> index ba52353074..c667d8574c 100644
>> --- a/libavformat/img2dec.c
>> +++ b/libavformat/img2dec.c
>> @@ -549,6 +549,8 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket
>> *pkt)
>>          }
>>      }
>>
>> +    memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>> +
>>      if (ret[0] <= 0 || ret[1] < 0 || ret[2] < 0) {
>>          if (ret[0] < 0) {
>>              res = ret[0];
>> --
>> 2.43.0
>>
>>
> Isn't this done generically already?
> Otherwise this fix is just fixing one single case of numerous others not
> covered.
> 

av_new_packet() is zeroing the padding, but in case that less is read
than intended the bytes after the payload bytes are uninitialized.

- Andreas