[FFmpeg-devel] [PATCH] avcodec/ilbcdec: Clear cbvec when used with create_augmented_vector() (PR #20178)

[michaelni]

PR #20178 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20178
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20178.patch

Fixes: use of uninitialized memory
Fixes: 42538134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>


From eeef95e0999d2230361315b67620f81a4e370cbb Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael at niedermayer.cc>
Date: Fri, 8 Aug 2025 15:03:56 +0200
Subject: [PATCH] avcodec/ilbcdec: Clear cbvec when used with
 create_augmented_vector()

Fixes: use of uninitialized memory
Fixes: 42538134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/ilbcdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c
index a9dfa857a2..b218ca323a 100644
--- a/libavcodec/ilbcdec.c
+++ b/libavcodec/ilbcdec.c
@@ -675,6 +675,7 @@ static void get_codebook(int16_t * cbvec,   /* (o) Constructed codebook vector *
         /* get vector */
         memcpy(cbvec, mem + lMem - k, cbveclen * 2);
     } else if (index < base_size) {
+        memset(cbvec, 0, cbveclen*2);
 
         /* Calculate lag */
 
@@ -701,6 +702,7 @@ static void get_codebook(int16_t * cbvec,   /* (o) Constructed codebook vector *
 
             filter_mafq12(&mem[memIndTest + 4], cbvec, kCbFiltersRev, CB_FILTERLEN, cbveclen);
         } else {
+            memset(cbvec, 0, cbveclen*2);
             /* interpolated vectors */
             /* Stuff zeros outside memory buffer  */
             memIndTest = lMem - cbveclen - CB_FILTERLEN;
-- 
2.49.1