File ffmpeg-4-CVE-2026-66038.patch of Package A_tw-ffmpeg-4

File ffmpeg-4-CVE-2026-66038.patch of Package A_tw-ffmpeg-4 (Revision 01d4c340a40540e63893c479c88a8479)

Currently displaying revision 01d4c340a40540e63893c479c88a8479 , Show latest

From e7cbfd1c507b57a806a5825b87d609963e862c8c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 28 Jun 2026 19:04:07 +0200
Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap
 disclosure

Fixes: use of uninitialized memory
Fixes: CsNDKB1K1U0C
Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/lcldec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Index: ffmpeg-4.4.8/libavcodec/lcldec.c
===================================================================
--- ffmpeg-4.4.8.orig/libavcodec/lcldec.c
+++ ffmpeg-4.4.8/libavcodec/lcldec.c
@@ -116,6 +116,9 @@ static unsigned int mszh_decomp(const un
         }
     }
 
+    if (destptr < destptr_end)
+        memset(destptr, 0, destptr_end - destptr);
+
     return destptr - destptr_bak;
 }
 
@@ -148,8 +151,11 @@ static int zlib_decomp(AVCodecContext *a
     if (expected != (unsigned int)c->zstream.total_out) {
         av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n",
                expected, c->zstream.total_out);
-        if (expected > (unsigned int)c->zstream.total_out)
+        if (expected > (unsigned int)c->zstream.total_out) {
+            memset(c->decomp_buf + offset + c->zstream.total_out, 0,
+                   c->decomp_size - offset - c->zstream.total_out);
             return (unsigned int)c->zstream.total_out;
+        }
         return AVERROR_UNKNOWN;
     }
     return c->zstream.total_out;