Opened 5 months ago

Closed 5 months ago

Last modified 5 months ago

#7866 closed defect (fixed)

libavcodec/scpr3.c:decompress_p3() use of uninitialized variable

Reported by: fisher Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: scpr
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

in static int decompress_p3(AVCodecContext *avctx,

uint32_t *dst, int linesize,
uint32_t *prev, int plinesize)

function, in

|int ret, temp, min, max, x, y, cx = 0, cx1 = 0;|

|temp| is not uninitialized ,and in

ret |= decode_value3(s, 255, &s->range_model3.cntsum,

s->range_model3.freqs[0],
s->range_model3.freqs[1],
s->range_model3.cnts,
s->range_model3.dectab, &temp);

decode_value3() function may fail and return without assigning a value to |temp|,so |temp| is still a uninitialized variable.

and in |min += temp << 8;| ,temp will be used.

Change History (8)

comment:1 Changed 5 months ago by jamrial

  • Analyzed by developer set
  • Status changed from new to open
  • Version changed from unspecified to git-master

comment:2 Changed 5 months ago by jamrial

  • Resolution set to fixed
  • Status changed from open to closed

comment:3 Changed 5 months ago by fisher

Hi ,will this case be assigned a cve?or will I receive a acknowledgement

comment:4 Changed 5 months ago by jamrial

Hi ,will this case be assigned a cve?

I don't manage that, so i don't know the requirements, but i suppose it wont because this code was not in any release.

or will I receive a acknowledgement

I'm not sure what you mean with this, but the commit that fixed the bug points to this bug report.

comment:5 Changed 5 months ago by fisher

In my experience,when I find a bug in a product,I report the bug to the developer.when they fix the bug,a
Cve will assign to this bug, and the bug
Finder will receive a acknowledgement .

comment:6 Changed 5 months ago by jamrial

As i said, i don't know how cve works, and i don't handle that stuff. But i don't think they will assign one for a bug that was not part of any release.

comment:7 Changed 5 months ago by fisher

Ok I get your point.

comment:8 Changed 5 months ago by cehoyos

  • Analyzed by developer unset
  • Keywords scpr added
Note: See TracTickets for help on using tickets.