indeo3: initialise pixel planes on allocation
authorKostya Shishkov <kostya.shishkov@gmail.com>
Mon, 14 May 2012 17:33:03 +0000 (19:33 +0200)
committerAnton Khirnov <anton@khirnov.net>
Sun, 20 Jan 2013 19:36:57 +0000 (20:36 +0100)
This prevents decoder from reading garbage from it in case of errors later.
(cherry picked from commit 81064a8045028838fd32d18490034c207c8ecc06)

Fixes an invalid read on sample from CVE-2012-2804

Signed-off-by: Anton Khirnov <anton@khirnov.net>
libavcodec/indeo3.c

index 48e5810..2aa8d95 100644 (file)
@@ -194,6 +194,8 @@ static av_cold int allocate_frame_buffers(Indeo3DecodeContext *ctx,
         /* set buffer pointers = buf_ptr + pitch and thus skip the INTRA prediction line */
         ctx->planes[p].pixels[0] = ctx->planes[p].buffers[0] + ctx->planes[p].pitch;
         ctx->planes[p].pixels[1] = ctx->planes[p].buffers[1] + ctx->planes[p].pitch;
+        memset(ctx->planes[p].pixels[0], 0, ctx->planes[p].pitch * ctx->planes[p].height);
+        memset(ctx->planes[p].pixels[1], 0, ctx->planes[p].pitch * ctx->planes[p].height);
     }
 
     return 0;