har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/asf: clear uninitialized areas of packets before returning them

Browse Source 
Fixes use of uninitialized variables
Fixes msan_uninit-mem_7f839282b6ce_7273_msn08_VBRq70_800x600.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-13 22:31:49 +01:00
parent 0f242e62b4
commit f5cf0ea93a
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libavformat/asf.h
View File

@ -43,6 +43,7 @@ typedef struct ASFStream {
int timestamp; int timestamp;
int64_t duration; int64_t duration;
int skip_to_key; int skip_to_key;
int pkt_clean;
int ds_span; /* descrambling */ int ds_span; /* descrambling */
int ds_packet_size; int ds_packet_size;

6
libavformat/asfdec.c
View File

@ -1191,6 +1191,7 @@ static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
asf_st->pkt.dts = asf->packet_frag_timestamp - asf->hdr.preroll; asf_st->pkt.dts = asf->packet_frag_timestamp - asf->hdr.preroll;
asf_st->pkt.stream_index = asf->stream_index; asf_st->pkt.stream_index = asf->stream_index;
asf_st->pkt.pos = asf_st->packet_pos = asf->packet_pos; asf_st->pkt.pos = asf_st->packet_pos = asf->packet_pos;
asf_st->pkt_clean = 0;
if (asf_st->pkt.data && asf_st->palette_changed) { if (asf_st->pkt.data && asf_st->palette_changed) {
uint8_t *pal; uint8_t *pal;
@ -1231,6 +1232,11 @@ static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
continue; continue;
} }
if (asf->packet_frag_offset != asf_st->frag_offset && !asf_st->pkt_clean) {
memset(asf_st->pkt.data + asf_st->frag_offset, 0, asf_st->pkt.size - asf_st->frag_offset);
asf_st->pkt_clean = 1;
}
ret = avio_read(pb, asf_st->pkt.data + asf->packet_frag_offset, ret = avio_read(pb, asf_st->pkt.data + asf->packet_frag_offset,
asf->packet_frag_size); asf->packet_frag_size);
if (ret != asf->packet_frag_size) { if (ret != asf->packet_frag_size) {