Commit f8e1a621 authored by Janne Grunau's avatar Janne Grunau

frame-mt: check delayed pics for decoding errors

Also mark all planes broken after tile error.
Fixes an use-of-uninitialized-value in apply_to_row_y() with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5652400153559040. Credits
to oss-fuzz.
parent 3fa2f04f
......@@ -2873,7 +2873,7 @@ int dav1d_decode_frame(Dav1dFrameContext *const f) {
}
if (progress == TILE_ERROR) {
dav1d_thread_picture_signal(&f->sr_cur, FRAME_ERROR,
progress_plane_type);
PLANE_TYPE_ALL);
const uint64_t all_mask = ~0ULL >> (64 - f->n_tc);
pthread_mutex_lock(&f->tile_thread.lock);
while (f->tile_thread.available != all_mask)
......
......@@ -237,8 +237,13 @@ int dav1d_get_picture(Dav1dContext *const c, Dav1dPicture *const out)
if (++c->frame_thread.next == c->n_fc)
c->frame_thread.next = 0;
if (out_delayed->p.data[0]) {
if (out_delayed->visible && !out_delayed->flushed)
const unsigned progress = atomic_load_explicit(&out_delayed->progress[1],
memory_order_relaxed);
if (out_delayed->visible && !out_delayed->flushed &&
progress != FRAME_ERROR)
{
dav1d_picture_ref(&c->out, &out_delayed->p);
}
dav1d_thread_picture_unref(out_delayed);
if (c->out.data[0])
return output_image(c, out, &c->out);
......
......@@ -41,6 +41,7 @@
#include "src/levels.h"
#include "src/obu.h"
#include "src/ref.h"
#include "src/thread_task.h"
static int parse_seq_hdr(Dav1dContext *const c, GetBits *const gb,
Av1SequenceHeader *const hdr)
......@@ -1316,8 +1317,13 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
Dav1dThreadPicture *const out_delayed =
&c->frame_thread.out_delayed[next];
if (out_delayed->p.data[0]) {
if (out_delayed->visible && !out_delayed->flushed)
const unsigned progress = atomic_load_explicit(&out_delayed->progress[1],
memory_order_relaxed);
if (out_delayed->visible && !out_delayed->flushed &&
progress != FRAME_ERROR)
{
dav1d_picture_ref(&c->out, &out_delayed->p);
}
dav1d_thread_picture_unref(out_delayed);
}
dav1d_thread_picture_ref(out_delayed,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment