commit d63da28bf141d7025b6d9038e042befb6419fa65
author Wan-Teh Chang <wtc@google.com> Wed Sep 05 17:27:17 2018 -0700
committer Yaowu Xu <yaowu@google.com> Thu Sep 06 03:31:26 2018 +0000
tree d312d7b816b8cf63e338f067f8b8946f4d40673c
parent 5d963cb5774d1649098c6f8a21674d676d241a0d

Zero-initialize the frame buffer.

We only need to zero-initialize the frame borders in the buffer, but it
is simpler to just zero-initialize the entire buffer.

Remove the previous workaround of calling set_planes_to_neutral_grey().

BUG=oss-fuzz:10227

Change-Id: I9a1dacc7fe54b04af3bede3984bb2012413707da

aom_scale/generic/yv12config.c

diff --git a/aom_scale/generic/yv12config.c b/aom_scale/generic/yv12config.c
index 72cd28a..0e58ba1 100644
--- a/aom_scale/generic/yv12config.c
+++ b/aom_scale/generic/yv12config.c
@@ -101,14 +101,10 @@
 
       ybf->buffer_alloc = (uint8_t *)yv12_align_addr(fb->data, 32);
 
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer)
-      // This memset is needed for fixing the issue of using uninitialized
-      // value in msan test. It will cause a perf loss, so only do this for
-      // msan test.
-      memset(ybf->buffer_alloc, 0, (int)frame_size);
-#endif
-#endif
+      // This memset is needed for fixing valgrind error from C loop filter
+      // due to access uninitialized memory in frame border. It could be
+      // removed if border is totally removed.
+      memset(ybf->buffer_alloc, 0, (size_t)frame_size);
     } else if (frame_size > (size_t)ybf->buffer_alloc_sz) {
       // Allocation to hold larger frame, or first allocation.
       aom_free(ybf->buffer_alloc);

av1/common/frame_buffers.c

diff --git a/av1/common/frame_buffers.c b/av1/common/frame_buffers.c
index 502ccd2..3bc0e7d 100644
--- a/av1/common/frame_buffers.c
+++ b/av1/common/frame_buffers.c
@@ -54,10 +54,7 @@
 
   if (int_fb_list->int_fb[i].size < min_size) {
     aom_free(int_fb_list->int_fb[i].data);
-    // The data must be zeroed to fix a valgrind error from the C loop filter
-    // due to access uninitialized memory in frame border. It could be
-    // skipped if border were totally removed.
-    int_fb_list->int_fb[i].data = (uint8_t *)aom_calloc(1, min_size);
+    int_fb_list->int_fb[i].data = (uint8_t *)aom_malloc(min_size);
     if (!int_fb_list->int_fb[i].data) return -1;
     int_fb_list->int_fb[i].size = min_size;
   }

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index 14d6cdc..2074f26 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -4380,7 +4380,6 @@
 
 static INLINE void reset_frame_buffers(AV1_COMMON *cm) {
   RefCntBuffer *const frame_bufs = cm->buffer_pool->frame_bufs;
-  const SequenceHeader *const seq_params = &cm->seq_params;
   int i;
 
   memset(&cm->ref_frame_map, -1, sizeof(cm->ref_frame_map));
@@ -4393,11 +4392,7 @@
       cm->buffer_pool->release_fb_cb(cm->buffer_pool->cb_priv,
                                      &frame_bufs[i].raw_frame_buffer);
     } else {
-      // Previous sequence with different bitdepth may have set to a
-      // neutral gray in different bit depth, need reset here.
-      YV12_BUFFER_CONFIG *cur_buf = &frame_bufs[i].buf;
-      if (cur_buf->buffer_alloc_sz >= cur_buf->frame_size)
-        set_planes_to_neutral_grey(seq_params, cur_buf, 0);
+      assert(frame_bufs[i].ref_count == 1);
     }
     frame_bufs[i].cur_frame_offset = 0;
     av1_zero(frame_bufs[i].ref_frame_offset);