[FFmpeg-cvslog] avcodec/dxa: add padding to decomp_buf

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Dec 19 17:14:59 2013 +0100| [f6c95f4f8c2f592c14239baf11a47b42170830e6] | committer: Michael Niedermayer

avcodec/dxa: add padding to decomp_buf

Fixes use of uninitialized memory
Fixes part of msan_uninit-mem_7f5ea8284fb7_8317_scummvm.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f6c95f4f8c2f592c14239baf11a47b42170830e6
---

 libavcodec/dxa.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c
index 1d96f10..e6750e9 100644
--- a/libavcodec/dxa.c
+++ b/libavcodec/dxa.c
@@ -42,6 +42,7 @@ typedef struct DxaDecContext {
     AVFrame *prev;
 
     int dsize;
+#define DECOMP_BUF_PADDING 16
     uint8_t *decomp_buf;
     uint32_t pal[256];
 } DxaDecContext;
@@ -245,6 +246,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
             av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n");
             return AVERROR_UNKNOWN;
         }
+        memset(c->decomp_buf + dsize, 0, DECOMP_BUF_PADDING);
     }
 
     if (avctx->debug & FF_DEBUG_PICT_INFO)
@@ -328,7 +330,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
     c->dsize = avctx->width * avctx->height * 2;
-    c->decomp_buf = av_malloc(c->dsize);
+    c->decomp_buf = av_malloc(c->dsize + DECOMP_BUF_PADDING);
     if (!c->decomp_buf) {
         av_frame_free(&c->prev);
         av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n");