shithub: dav1d

Info  •  Files  •  Log  •  Branches

tile-mt: reset tile tasks when the number of tile rows changes

Fixes an assert in dav1d_prepare_intra_edges_16bpc() with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5640098964570112. Credits
to oss-fuzz.

--- a/src/decode.c

+++ b/src/decode.c

@@ -2505,7 +2505,8 @@

             f->tile_thread.titsati_sz = f->frame_hdr->tiling.cols * f->sbh;

         }

         if (f->tile_thread.titsati_init[0] != f->frame_hdr->tiling.cols ||

-            f->tile_thread.titsati_init[1] != f->sbh)

+            f->tile_thread.titsati_init[1] != f->sbh ||

+            f->tile_thread.titsati_init[2] != f->frame_hdr->tiling.rows)

         {

             for (int tile_row = 0, tile_idx = 0;

                  tile_row < f->frame_hdr->tiling.rows; tile_row++)

@@ -2524,6 +2525,7 @@

             }

             f->tile_thread.titsati_init[0] = f->frame_hdr->tiling.cols;

             f->tile_thread.titsati_init[1] = f->sbh;

+            f->tile_thread.titsati_init[2] = f->frame_hdr->tiling.rows;

         }

     }

--- a/src/internal.h

+++ b/src/internal.h

@@ -224,7 +224,7 @@

         pthread_cond_t cond, icond;

         int tasks_left, num_tasks;

         int (*task_idx_to_sby_and_tile_idx)[2];

-        int titsati_sz, titsati_init[2];

+        int titsati_sz, titsati_init[3];

     } tile_thread;

 };