commit 1f68feef03dd9d5b5a4cac0a8f69b9f4cb1da915
author Yunqing Wang <yunqingwang@google.com> Mon Jul 02 12:39:09 2018 -0700
committer Yunqing Wang <yunqingwang@google.com> Mon Jul 02 23:32:16 2018 +0000
tree e8103ddcd7703d4411009e509397c196ee9c81cf
parent 6c5d07efa2b887fee25836e85a9f50f897c6c806

Set thread_data->error_info.setjmp correctly

This patch fixed the setting of thread_data->error_info.setjmp,
which was missing in current code.

Also, set the error_info pointer in macroblockd to the error_info
structure in thread_data.

These changes ultimately fix a decoder fuzzing bug in
decode_partition().

BUG=oss-fuzz:9188,9124

Change-Id: I9864f85efab2f14dd20ce80d6bc889edb1218715

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index f80966e..4c9120b 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -1441,7 +1441,7 @@
   const struct macroblockd_plane *const pd_u = &xd->plane[1];
   if (get_plane_block_size(subsize, pd_u->subsampling_x, pd_u->subsampling_y) ==
       BLOCK_INVALID) {
-    aom_internal_error(&cm->error, AOM_CODEC_CORRUPT_FRAME,
+    aom_internal_error(xd->error_info, AOM_CODEC_CORRUPT_FRAME,
                        "Block size %dx%d invalid with this subsampling mode",
                        block_size_wide[subsize], block_size_high[subsize]);
   }
@@ -2758,6 +2758,7 @@
   }
 #endif
   av1_init_macroblockd(cm, &td->xd, td->dqcoeff);
+  td->xd.error_info = &thread_data->error_info;
   av1_init_above_context(cm, &td->xd, tile_row);
 
   // Initialise the tile context from the frame context
@@ -2783,6 +2784,8 @@
     thread_data->td->xd.corrupted = 1;
     return 0;
   }
+  thread_data->error_info.setjmp = 1;
+
   allow_update_cdf = cm->large_scale_tile ? 0 : 1;
   allow_update_cdf = allow_update_cdf && !cm->disable_cdf_update;