File CVE-2023-6349.patch of Package libvpx.34569
commit df9fd9d5b7325060b2b921558a1eb20ca7880937
Author: Jerome Jiang <jianj@google.com>
Date: Thu Jun 30 13:48:56 2022 -0400
Fix bug with smaller width bigger size
Fixed previous patch that clusterfuzz failed on.
Local fuzzing passing overnight.
Bug: webm:1642
Change-Id: If0e08e72abd2e042efe4dcfac21e4cc51afdfdb9
(cherry picked from commit 263682c9a29395055f3b3afe2d97be1828a6223f)
Index: libvpx-1.6.1/vp9/common/vp9_alloccommon.c
===================================================================
--- libvpx-1.6.1.orig/vp9/common/vp9_alloccommon.c
+++ libvpx-1.6.1/vp9/common/vp9_alloccommon.c
@@ -75,6 +75,7 @@ static void free_seg_map(VP9_COMMON *cm)
vpx_free(cm->seg_map_array[i]);
cm->seg_map_array[i] = NULL;
}
+ cm->seg_map_alloc_size = 0;
cm->current_frame_seg_map = NULL;
@@ -118,6 +119,7 @@ void vp9_free_context_buffers(VP9_COMMON
cm->above_context = NULL;
vpx_free(cm->above_seg_context);
cm->above_seg_context = NULL;
+ cm->above_context_alloc_cols = 0;
vpx_free(cm->lf.lfm);
cm->lf.lfm = NULL;
}