File ffmpeg-8-CVE-2026-70629.patch of Package A_tw-ffmpeg-8

From a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 22 Jul 2026 05:44:03 +0200
Subject: [PATCH] avcodec/rscc: do not leave uninitilized data when the input
 is too short

Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
(cherry picked from commit cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rscc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
index 3715e1c6d4..5fde30ec35 100644
--- a/libavcodec/rscc.c
+++ b/libavcodec/rscc.c
@@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame,
             ret = AVERROR_UNKNOWN;
             goto end;
         }
+        if (len < pixel_size) {
+            av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n",
+                   len, pixel_size);
+            memset(ctx->inflated_buf + len, 0, pixel_size - len);
+            pixel_size = len;
+        }
         pixels = ctx->inflated_buf;
     }
 
-- 
2.49.0