PR #23626 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626.patch Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> From 4e5c0df681ef9284f55d91dc488d5a3a35d02405 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael@niedermayer.cc> Date: Sun, 28 Jun 2026 19:04:07 +0200 Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/lcldec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index 29b1d85be3..5023243017 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -120,6 +120,9 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign } } + if (destptr < destptr_end) + memset(destptr, 0, destptr_end - destptr); + return destptr - destptr_bak; } @@ -153,8 +156,11 @@ static int zlib_decomp(AVCodecContext *avctx, const uint8_t *src, int src_len, i if (expected != (unsigned int)zstream->total_out) { av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n", expected, zstream->total_out); - if (expected > (unsigned int)zstream->total_out) + if (expected > (unsigned int)zstream->total_out) { + memset(c->decomp_buf + offset + zstream->total_out, 0, + c->decomp_size - offset - zstream->total_out); return (unsigned int)zstream->total_out; + } return AVERROR_UNKNOWN; } return zstream->total_out; -- 2.52.0