10204.diff

commit bb5c2833051f4bc8d084bbbe8c8adbdad7dd5449
Author: Yaowu Xu <yaowu@google.com>
Date:   Tue Sep 4 11:46:28 2018 -0700

    Limit buffer reset to only when it is necessary
    
    This commit adds conditions to reset pixel values in frame buffer,
    so to limit the buffer reset to only when reset is necessary.
    
    BUG=oss-fuzz:10204
    BUG=oss-fuzz:10200
    BUG=oss-fuzz:10209
    
    Change-Id: I0cbece6b7c2c4db29314a59df5c27fa7682d3042

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index 0a5032808f..14d6cdc548 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -86,22 +86,21 @@ int av1_check_trailing_bits(AV1Decoder *pbi, struct aom_read_bit_buffer *rb) {
 // Use only_chroma = 1 to only set the chroma planes
 static void set_planes_to_neutral_grey(const SequenceHeader *const seq_params,
                                        const YV12_BUFFER_CONFIG *const buf,
                                        int only_chroma) {
   const int val = 1 << (seq_params->bit_depth - 1);
-
   for (int plane = only_chroma; plane < MAX_MB_PLANE; plane++) {
     const int is_uv = plane > 0;
     for (int row_idx = 0; row_idx < buf->crop_heights[is_uv]; row_idx++) {
       if (seq_params->use_highbitdepth) {
         // TODO(yaowu): replace this with aom_memset16() for speed
         for (int col_idx = 0; col_idx < buf->crop_widths[is_uv]; col_idx++) {
           uint16_t *base = CONVERT_TO_SHORTPTR(buf->buffers[plane]);
           base[row_idx * buf->strides[is_uv] + col_idx] = val;
         }
       } else {
         memset(&buf->buffers[plane][row_idx * buf->uv_stride], 1 << 7,
                buf->crop_widths[is_uv]);
       }
     }
   }
 }
@@ -4382,26 +4381,29 @@ static void show_existing_frame_reset(AV1Decoder *const pbi,
 static INLINE void reset_frame_buffers(AV1_COMMON *cm) {
   RefCntBuffer *const frame_bufs = cm->buffer_pool->frame_bufs;
   const SequenceHeader *const seq_params = &cm->seq_params;
   int i;
 
   memset(&cm->ref_frame_map, -1, sizeof(cm->ref_frame_map));
   memset(&cm->next_ref_frame_map, -1, sizeof(cm->next_ref_frame_map));
 
   lock_buffer_pool(cm->buffer_pool);
   for (i = 0; i < FRAME_BUFFERS; ++i) {
     if (i != cm->new_fb_idx) {
       frame_bufs[i].ref_count = 0;
       cm->buffer_pool->release_fb_cb(cm->buffer_pool->cb_priv,
                                      &frame_bufs[i].raw_frame_buffer);
+    } else {
+      // Previous sequence with different bitdepth may have set to a
+      // neutral gray in different bit depth, need reset here.
+      YV12_BUFFER_CONFIG *cur_buf = &frame_bufs[i].buf;
+      if (cur_buf->buffer_alloc_sz >= cur_buf->frame_size)
+        set_planes_to_neutral_grey(seq_params, cur_buf, 0);
     }
     frame_bufs[i].cur_frame_offset = 0;
-    // Previous sequence with different bitdepth may have set to a
-    // neutral gray in different bit depth, need reset here.
-    set_planes_to_neutral_grey(seq_params, &frame_bufs[i].buf, 0);
     av1_zero(frame_bufs[i].ref_frame_offset);
   }
   unlock_buffer_pool(cm->buffer_pool);
 }
 
 // On success, returns 0. On failure, calls aom_internal_error and does not
 // return.