[FFmpeg-cvslog] avformat/jpegxl_anim_dec: ensure input padding is zeroed

[Kacper Michajłow]

ffmpeg | branch: master | Kacper Michajłow <kasper93 at gmail.com> | Thu Jun 27 02:40:37 2024 +0200| [2b5f000d3f6f9e737e918a5438e6c881f65e70e2] | committer: Michael Niedermayer

avformat/jpegxl_anim_dec: ensure input padding is zeroed

Fixes use of uninitialized value, reported by MSAN.

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow <kasper93 at gmail.com>

Fixes: 70837/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5089407768526848
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2b5f000d3f6f9e737e918a5438e6c881f65e70e2
---

 libavformat/jpegxl_anim_dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c
index ac95d3b961..2338a2e8c0 100644
--- a/libavformat/jpegxl_anim_dec.c
+++ b/libavformat/jpegxl_anim_dec.c
@@ -124,6 +124,8 @@ static int jpegxl_anim_read_header(AVFormatContext *s)
         }
     }
 
+    memset(head + headsize, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
     /* offset in bits of the animation header */
     ret = ff_jpegxl_parse_codestream_header(head, headsize, &meta, 0);
     if (ret < 0 || meta.animation_offset <= 0)