Browse Source

avformat/asf: clear uninitialized areas of packets before returning them

Fixes use of uninitialized variables
Fixes msan_uninit-mem_7f839282b6ce_7273_msn08_VBRq70_800x600.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.2-rc1
Michael Niedermayer 12 years ago
parent
commit
f5cf0ea93a
2 changed files with 7 additions and 0 deletions
  1. +1
    -0
      libavformat/asf.h
  2. +6
    -0
      libavformat/asfdec.c

+ 1
- 0
libavformat/asf.h View File

@@ -43,6 +43,7 @@ typedef struct ASFStream {
int timestamp;
int64_t duration;
int skip_to_key;
int pkt_clean;

int ds_span; /* descrambling */
int ds_packet_size;


+ 6
- 0
libavformat/asfdec.c View File

@@ -1191,6 +1191,7 @@ static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
asf_st->pkt.dts = asf->packet_frag_timestamp - asf->hdr.preroll;
asf_st->pkt.stream_index = asf->stream_index;
asf_st->pkt.pos = asf_st->packet_pos = asf->packet_pos;
asf_st->pkt_clean = 0;

if (asf_st->pkt.data && asf_st->palette_changed) {
uint8_t *pal;
@@ -1231,6 +1232,11 @@ static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
continue;
}

if (asf->packet_frag_offset != asf_st->frag_offset && !asf_st->pkt_clean) {
memset(asf_st->pkt.data + asf_st->frag_offset, 0, asf_st->pkt.size - asf_st->frag_offset);
asf_st->pkt_clean = 1;
}

ret = avio_read(pb, asf_st->pkt.data + asf->packet_frag_offset,
asf->packet_frag_size);
if (ret != asf->packet_frag_size) {


Loading…
Cancel
Save