[FFmpeg-devel] [PATCH 1/4] avcodec/jpegxl_parser: ensure input padding is zeroed

[Kacper Michajlow]

On Thu, 27 Jun 2024 at 02:55, Andreas Rheinhardt
<andreas.rheinhardt at outlook.com> wrote:
>
> Kacper Michajłow:
> > Fixes use of uninitialized value, reported by MSAN.
> >
> > Found by OSS-Fuzz.
> >
> > Signed-off-by: Kacper Michajłow <kasper93 at gmail.com>
> > ---
> >  libavcodec/jpegxl_parser.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
> > index 8c45e1a1b7..f833f844c4 100644
> > --- a/libavcodec/jpegxl_parser.c
> > +++ b/libavcodec/jpegxl_parser.c
> > @@ -1419,6 +1419,7 @@ static int try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseCon
> >          }
> >          cs_buffer = ctx->cs_buffer;
> >          cs_buflen = FFMIN(sizeof(ctx->cs_buffer) - AV_INPUT_BUFFER_PADDING_SIZE, ctx->copied);
> > +        memset(ctx->cs_buffer + cs_buflen, 0, AV_INPUT_BUFFER_PADDING_SIZE);
> >      } else {
> >          cs_buffer = buf;
> >          cs_buflen = buf_size;
>
> This is very strange: The buffer here is part of the parser's private
> context and this is zeroed initially. So it should never contain
> uninitialized values.

You are right, but reading this code I had the feeling that it would
have the same issue, we read only ctx->copied amount of bytes. We can
skip this one if this is certain that this buffer will be clear before
reuse always.