avformat/jvdec: clear packet padding after downsize
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 15 Jan 2014 22:06:30 +0000 (23:06 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 15 Jan 2014 22:13:03 +0000 (23:13 +0100)
Fixes: use of uninitialized memeory
Fixes: msan_uninit-mem_7fbf26b5fefe_5981_intro.jv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/jvdec.c

index 03ac43d..27ec7ad 100644 (file)
@@ -190,6 +190,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
                 pkt->data[4]      = jvf->video_type;
                 if ((size = avio_read(pb, pkt->data + JV_PREAMBLE_SIZE, size)) < 0)
                     return AVERROR(EIO);
+                memset(pkt->data + JV_PREAMBLE_SIZE + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
 
                 pkt->size         = size + JV_PREAMBLE_SIZE;
                 pkt->stream_index = 1;