This testcase was generated with a modified aomenc to insert sequence
headers before every frame and writing random data into the
encoder_buffer_delay bitsream field. See dav1d!593

Add testcase for #248.

A new sequence starts in the middle of these, unlike samples where the
frame_size_override_flag field is used to signal size changes in a per
frame basis.
The samples were remuxed into ivf from the original Mastroska container
in the libaom suite so they may be decodable with the dav1d CLI.

Tested to be bitexact with the output of aomdec.

==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7fcdfe228a00,0x7fcdfe228b00) and [0x7fcdfe228902, 0x7fcdfe228a02) overlap
SCARINESS: 10 (memcpy-param-overlap)
    #0 0x4e99c9 in __asan_memcpy _asan_rtl_
    #1 0x60d4a4 in put_c /src/dav1d/src/mc_tmpl.c:52:9
    #2 0x6075ae in put_bilin_c /src/dav1d/src/mc_tmpl.c:433:9
    #3 0x62f33f in mc /src/dav1d/src/recon_tmpl.c:546:13
    #4 0x626789 in dav1d_recon_b_inter_16bpc /src/dav1d/src/recon_tmpl.c:1170:15
    #5 0x55fa2d in decode_b /src/dav1d/src/decode.c:1322:17
    #6 0x543d8a in decode_sb /src/dav1d/src/decode.c:1957:17
    #7 0x542a68 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #8 0x533455 in dav1d_tile_task /src/dav1d/src/thread_task.c:92:29
    #9 0x7fce056266b9 in start_thread
    #10 0x7fce04a3141c in clone /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
0x7fcdfe228a00 is located 512 bytes inside of 442368-byte region [0x7fcdfe228800,0x7fcdfe294800)
allocated by thread T0 here:
    #0 0x4ec168 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52c5b1 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52c324 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x52c057 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x52caae in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x52c7b4 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x54f4b3 in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x53427b in dav1d_parse_obus /src/dav1d/src/obu.c:1412:24
    #8 0x531926 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x52bc70 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x64b15a in ExecuteFilesOnyByOne(int, char**) /src/libfuzzer/afl/afl_driver.cpp:301:5
    #11 0x64b6be in main /src/libfuzzer/afl/afl_driver.cpp:339:12
    #12 0x7fce0494a82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Thread T2 created by T0 here:
    #0 0x43694d in __interceptor_pthread_create _asan_rtl_
    #1 0x52f337 in dav1d_open /src/dav1d/src/lib.c:137:17
    #2 0x52baee in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:118:11
    #3 0x64b15a in ExecuteFilesOnyByOne(int, char**) /src/libfuzzer/afl/afl_driver.cpp:301:5
    #4 0x64b6be in main /src/libfuzzer/afl/afl_driver.cpp:339:12
    #5 0x7fce0494a82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
0x7fcdfe228902 is located 258 bytes inside of 442368-byte region [0x7fcdfe228800,0x7fcdfe294800)
allocated by thread T0 here:
    #0 0x4ec168 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52c5b1 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52c324 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x52c057 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x52caae in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x52c7b4 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x54f4b3 in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x53427b in dav1d_parse_obus /src/dav1d/src/obu.c:1412:24
    #8 0x531926 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x52bc70 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x64b15a in ExecuteFilesOnyByOne(int, char**) /src/libfuzzer/afl/afl_driver.cpp:301:5
    #11 0x64b6be in main /src/libfuzzer/afl/afl_driver.cpp:339:12
    #12 0x7fce0494a82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5a4a74 in iclip /src/dav1d/include/common/intops.h:44:28
    #1 0x59adbe in put_bilin_c /src/dav1d/src/mc_tmpl.c:417:30
    #2 0x5d91ca in mc /src/dav1d/src/recon_tmpl.c:546:13
    #3 0x5cc844 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1174:19
    #4 0x4e9f8f in decode_b /src/dav1d/src/decode.c:738:17
    #5 0x4cccc8 in decode_sb /src/dav1d/src/decode.c:1957:17
    #6 0x4c8b69 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2374:17
    #7 0x4ae294 in dav1d_tile_task /src/dav1d/src/thread_task.c:92:29
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
    #9 0x7f5d7ded16b9 in start_thread
    #10 0x7f5d7d2dc41c in clone /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x5a125d in emu_edge_c /src/dav1d/src/mc_tmpl.c:829:9
    #2 0x5d8f12 in mc /src/dav1d/src/recon_tmpl.c:535:13
    #3 0x5cc844 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1174:19
    #4 0x4e9f8f in decode_b /src/dav1d/src/decode.c:738:17
    #5 0x4cccc8 in decode_sb /src/dav1d/src/decode.c:1957:17
    #6 0x4c8b69 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2374:17
    #7 0x4ae294 in dav1d_tile_task /src/dav1d/src/thread_task.c:92:29
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a13a9 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a0e48 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x4a08c3 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x4a1ce8 in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x4a17c8 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x4df71b in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x4b01eb in dav1d_parse_obus /src/dav1d/src/obu.c:1412:24
    #8 0x4aac80 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x4a00de in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x6e69ab in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x69e956 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x6af77a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x69da81 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7f5d7d1f582f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x56c54f in splat_dc /src/dav1d/src/ipred_tmpl.c:45:5
    #1 0x5c3c04 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:837:21
    #2 0x4f1e28 in decode_b /src/dav1d/src/decode.c:1162:13
    #3 0x4cc5d7 in decode_sb /src/dav1d/src/decode.c:2159:17
    #4 0x4cc6de in decode_sb /src/dav1d/src/decode.c:2155:17
    #5 0x4ca610 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #6 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #7 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
    #8 0x7fa03b2e36b9 in start_thread
    #9 0x7fa03a6ee41c in clone /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x67d6ac in dav1d_prepare_intra_edges_8bpc /src/dav1d/src/ipred_prepare_tmpl.c:174:13
    #2 0x5c3987 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:826:25
    #3 0x4f1e28 in decode_b /src/dav1d/src/decode.c:1162:13
    #4 0x4cc5d7 in decode_sb /src/dav1d/src/decode.c:2159:17
    #5 0x4cc6de in decode_sb /src/dav1d/src/decode.c:2155:17
    #6 0x4ca610 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #7 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x5a4f2f in put_c /src/dav1d/src/mc_tmpl.c:52:9
    #2 0x5d981a in mc /src/dav1d/src/recon_tmpl.c:546:13
    #3 0x5cbee8 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1170:15
    #4 0x4fcdf7 in decode_b /src/dav1d/src/decode.c:1322:17
    #5 0x4cc5d7 in decode_sb /src/dav1d/src/decode.c:2159:17
    #6 0x4cc4b7 in decode_sb /src/dav1d/src/decode.c:2153:17
    #7 0x4ca610 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #8 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #9 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a13a9 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a0e48 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x4a08c3 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x4a1ce8 in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x4a17c8 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x4df71b in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x4b01eb in dav1d_parse_obus /src/dav1d/src/obu.c:1412:24
    #8 0x4aac80 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x4a00de in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x6e6ffb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x69efa6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x6afdca in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x69e0d1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7fa03a60782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x578b54 in iclip /src/dav1d/include/common/intops.h:44:12
    #1 0x5799ef in inv_txfm_add_c /src/dav1d/src/itx_tmpl.c:87:17
    #2 0x5780ad in inv_txfm_add_dct_dct_32x8_c /src/dav1d/src/itx_tmpl.c:145:1
    #3 0x5d37a5 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1566:29
    #4 0x4fce77 in decode_b /src/dav1d/src/decode.c:1322:17
    #5 0x4cdf35 in decode_sb /src/dav1d/src/decode.c:2072:17
    #6 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #7 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
    #9 0x7ff6957dc6b9 in start_thread
    #10 0x7ff694be741c in clone /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x5a3c6f in put_c /src/dav1d/src/mc_tmpl.c:52:9
    #2 0x5d855a in mc /src/dav1d/src/recon_tmpl.c:546:13
    #3 0x5cbbd4 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1174:19
    #4 0x4fce77 in decode_b /src/dav1d/src/decode.c:1322:17
    #5 0x4cdf35 in decode_sb /src/dav1d/src/decode.c:2072:17
    #6 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #7 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a13a9 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a0e48 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x4a08c3 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x4a1ce8 in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x4a17c8 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x4df79b in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x4aff75 in dav1d_parse_obus /src/dav1d/src/obu.c:1410:24
    #8 0x4aac80 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x4a00de in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x6e4dfb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x69cda6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x6adbca in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x69bed1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7ff694b0082f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x56ed14 in iclip /src/dav1d/include/common/intops.h:44:12
    #1 0x5692b7 in ipred_z2_c /src/dav1d/src/ipred_tmpl.c:545:22
    #2 0x5c2944 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:837:21
    #3 0x4f1ea8 in decode_b /src/dav1d/src/decode.c:1162:13
    #4 0x4cd6b8 in decode_sb /src/dav1d/src/decode.c:2016:17
    #5 0x4ccf88 in decode_sb /src/dav1d/src/decode.c:1998:21
    #6 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #7 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
    #9 0x7fcc00f236b9 in start_thread
    #10 0x7fcc0032e41c in clone /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
  Uninitialized value was stored to memory at
    #0 0x569855 in ipred_z2_c /src/dav1d/src/ipred_tmpl.c:520:14
    #1 0x5c2944 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:837:21
    #2 0x4f1ea8 in decode_b /src/dav1d/src/decode.c:1162:13
    #3 0x4cd6b8 in decode_sb /src/dav1d/src/decode.c:2016:17
    #4 0x4ccf88 in decode_sb /src/dav1d/src/decode.c:1998:21
    #5 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #6 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #7 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was stored to memory at
    #0 0x67bfa1 in dav1d_prepare_intra_edges_8bpc /src/dav1d/src/ipred_prepare_tmpl.c:205:26
    #1 0x5c26c7 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:826:25
    #2 0x4f1ea8 in decode_b /src/dav1d/src/decode.c:1162:13
    #3 0x4cd6b8 in decode_sb /src/dav1d/src/decode.c:2016:17
    #4 0x4ccf88 in decode_sb /src/dav1d/src/decode.c:1998:21
    #5 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #6 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #7 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was stored to memory at
    #0 0x67bf90 in dav1d_prepare_intra_edges_8bpc /src/dav1d/src/ipred_prepare_tmpl.c:0:16
    #1 0x5c26c7 in dav1d_recon_b_intra_8bpc /src/dav1d/src/recon_tmpl.c:826:25
    #2 0x4f1ea8 in decode_b /src/dav1d/src/decode.c:1162:13
    #3 0x4cd6b8 in decode_sb /src/dav1d/src/decode.c:2016:17
    #4 0x4ccf88 in decode_sb /src/dav1d/src/decode.c:1998:21
    #5 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #6 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #7 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x5ddffd in dav1d_backup_ipred_edge_8bpc /src/dav1d/src/recon_tmpl.c:1666:5
    #2 0x4cab14 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2479:9
    #3 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #4 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was stored to memory at
    #0 0x45f31d in __msan_memcpy.part.51 /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:1490
    #1 0x5a3c6f in put_c /src/dav1d/src/mc_tmpl.c:52:9
    #2 0x5d855a in mc /src/dav1d/src/recon_tmpl.c:546:13
    #3 0x5cac28 in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1170:15
    #4 0x4fce77 in decode_b /src/dav1d/src/decode.c:1322:17
    #5 0x4ccd48 in decode_sb /src/dav1d/src/decode.c:1957:17
    #6 0x4ca690 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #7 0x4ae5e5 in dav1d_tile_task /src/dav1d/src/thread_task.c:128:25
    #8 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a13a9 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a0e48 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x4a08c3 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:66:12
    #4 0x4a1ce8 in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x4a17c8 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:156:9
    #6 0x4df79b in dav1d_submit_frame /src/dav1d/src/decode.c:3125:11
    #7 0x4aff75 in dav1d_parse_obus /src/dav1d/src/obu.c:1410:24
    #8 0x4aac80 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #9 0x4a00de in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19
    #10 0x6e4dfb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x69cda6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x6adbca in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x69bed1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7fcc0024782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

Janne Grunau authored 6 years ago and Jean-Baptiste Kempf committed 6 years ago

../../src/dav1d/src/itx_1d.c:803:40: runtime error: signed integer overflow: -924106 * 2896 cannot be represented in type 'int'
     #0 0x4b9192 in inv_adst16_1d /src/dav1d/src/itx_1d.c:803:40
     #1 0x4b3e5d in inv_txfm_add_c /src/dav1d/src/itx_tmpl.c:0
     #2 0x4b289f in inv_txfm_add_adst_identity_16x4_c /src/dav1d/src/itx_tmpl.c:140:1
    #3 0x4d6b47 in read_coef_tree /src/dav1d/src/recon_tmpl.c:353:17
    #4 0x4dd7b4 in dav1d_recon_b_inter_16bpc /src/dav1d/src/recon_tmpl.c:1505:21
    #5 0x44ccc7 in decode_b /src/dav1d/src/decode.c:1827:17
    #6 0x43d2e9 in decode_sb /src/dav1d/src/decode.c:2072:17
    #7 0x43dbd3 in decode_sb /src/dav1d/src/decode.c:2005:21
    #8 0x43cd41 in decode_sb /src/dav1d/src/decode.c:2155:17
    #9 0x43c041 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13

Janne Grunau authored 6 years ago and Jean-Baptiste Kempf committed 6 years ago

../../src/dav1d/src/itx_1d.c:46:27: runtime error: signed integer overflow: 1007563 * 2896 cannot be represented in type 'int'
    #0 0x4b45a0 in inv_dct4_1d /src/dav1d/src/itx_1d.c:46:27
    #1 0x4b4c0c in inv_dct8_1d /src/dav1d/src/itx_1d.c:63:5
    #2 0x4b3cdd in inv_txfm_add_c /src/dav1d/src/itx_tmpl.c:0
    #3 0x4b18df in inv_txfm_add_dct_identity_8x8_c /src/dav1d/src/itx_tmpl.c:137:1
    #4 0x4d69c7 in read_coef_tree /src/dav1d/src/recon_tmpl.c:353:17
    #5 0x4dd634 in dav1d_recon_b_inter_16bpc /src/dav1d/src/recon_tmpl.c:1505:21
    #6 0x44cc67 in decode_b /src/dav1d/src/decode.c:1827:17
    #7 0x43cdf4 in decode_sb /src/dav1d/src/decode.c:1957:17
    #8 0x43dd58 in decode_sb /src/dav1d/src/decode.c:2008:21
    #9 0x43daf3 in decode_sb /src/dav1d/src/decode.c:2005:21
    #10 0x43dd58 in decode_sb /src/dav1d/src/decode.c:2008:21
    #11 0x43d26d in decode_sb /src/dav1d/src/decode.c:1998:21
    #12 0x43bf61 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #13 0x440d34 in dav1d_decode_frame /src/dav1d/src/decode.c:2836:29
    #14 0x444af5 in dav1d_submit_frame /src/dav1d/src/decode.c:3287:20
    #15 0x4340ec in dav1d_parse_obus /src/dav1d/src/obu.c:1411:24
    #16 0x43232e in dav1d_get_picture /src/dav1d/src/lib.c:327:15
    #17 0x42f182 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19

Janne Grunau authored 6 years ago and Jean-Baptiste Kempf committed 6 years ago

third_party/dav1d/src/itx_1d.c:843:44: runtime error: signed integer overflow: 409458 * 5793 cannot be represented in type 'int'
    #0 0x55e622a461da in inv_identity16_1d third_party/dav1d/src/itx_1d.c:843:44
    #1 0x55e622a4154f in inv_txfm_add_c third_party/dav1d/src/itx_tmpl.c
    #2 0x55e622a408ac in inv_txfm_add_identity_identity_16x16_c third_party/dav1d/src/itx_tmpl.c:142:1
    #3 0x55e622a80a6a in dav1d_recon_b_intra_16bpc third_party/dav1d/src/recon_tmpl.c:890:29
    #4 0x55e6229b9b9e in decode_b third_party/dav1d/src/decode.c:1162:13
    #5 0x55e6229a1abb in decode_sb third_party/dav1d/src/decode.c:2072:17
    #6 0x55e62299f07b in dav1d_decode_tile_sbrow third_party/dav1d/src/decode.c:2469:13
    #7 0x55e6229a959c in dav1d_decode_frame third_party/dav1d/src/decode.c:2838:29
    #8 0x55e6229af362 in dav1d_submit_frame third_party/dav1d/src/decode.c:3302:20
    #9 0x55e6229f0a92 in dav1d_parse_obus third_party/dav1d/src/obu.c:1410:24
    #10 0x55e622a19666 in dav1d_get_picture third_party/dav1d/src/lib.c:347:15
    #11 0x55e622989759 in LLVMFuzzerTestOneInput third_party/dav1d/tests/libfuzzer/dav1d_fuzzer.c:156:19

==1==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4eb5ff in malloc _asan_rtl_
    #1 0x52eb17 in dav1d_ref_wrap /src/dav1d/src/ref.c:58:21
    #2 0x52e96c in dav1d_ref_create /src/dav1d/src/ref.c:46:11
    #3 0x592299 in dav1d_cdf_thread_alloc /src/dav1d/src/cdf.c:4182:16
    #4 0x5511af in dav1d_submit_frame /src/dav1d/src/decode.c:3114:15
    #5 0x534fb0 in dav1d_parse_obus /src/dav1d/src/obu.c:1410:24
    #6 0x532017 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #7 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #8 0x6808b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #9 0x6560dd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #10 0x661926 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #11 0x65575c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #12 0x7f185d17982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Indirect leak of 20824 byte(s) in 1 object(s) allocated from:
    #0 0x4ec488 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52ea4d in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52e952 in dav1d_ref_create /src/dav1d/src/ref.c:41:18
    #3 0x592299 in dav1d_cdf_thread_alloc /src/dav1d/src/cdf.c:4182:16
    #4 0x5511af in dav1d_submit_frame /src/dav1d/src/decode.c:3114:15
    #5 0x534fb0 in dav1d_parse_obus /src/dav1d/src/obu.c:1410:24
    #6 0x532017 in dav1d_get_picture /src/dav1d/src/lib.c:347:15
    #7 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #8 0x6808b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #9 0x6560dd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #10 0x661926 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #11 0x65575c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #12 0x7f185d17982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
SUMMARY: AddressSanitizer: 20864 byte(s) leaked in 2 allocation(s).

Use a list of name, file, md5 as test definition and loop over it to
instantiate tests.

==1==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4eb5ff in malloc _asan_rtl_
    #1 0x52eb07 in dav1d_ref_wrap /src/dav1d/src/ref.c:58:21
    #2 0x52e95c in dav1d_ref_create /src/dav1d/src/ref.c:46:11
    #3 0x534297 in dav1d_parse_obus /src/dav1d/src/obu.c:1232:25
    #4 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #5 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #6 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4eb5ff in malloc _asan_rtl_
    #1 0x52eb07 in dav1d_ref_wrap /src/dav1d/src/ref.c:58:21
    #2 0x52cf83 in picture_alloc_with_edges /src/dav1d/src/picture.c:134:20
    #3 0x52cc04 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:155:9
    #4 0x550f03 in dav1d_submit_frame /src/dav1d/src/decode.c:3120:11
    #5 0x534b29 in dav1d_parse_obus /src/dav1d/src/obu.c:1411:24
    #6 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #7 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #8 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #9 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #10 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #11 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #12 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4eb5ff in malloc _asan_rtl_
    #1 0x52eb07 in dav1d_ref_wrap /src/dav1d/src/ref.c:58:21
    #2 0x52e95c in dav1d_ref_create /src/dav1d/src/ref.c:46:11
    #3 0x535434 in dav1d_parse_obus /src/dav1d/src/obu.c:1271:32
    #4 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #5 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #6 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Indirect leak of 933888 byte(s) in 1 object(s) allocated from:
    #0 0x4ec488 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52c9fd in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52c753 in default_picture_allocator /src/dav1d/src/picture.c:60:21
    #3 0x52c44d in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:52:12
    #4 0x52cf28 in picture_alloc_with_edges /src/dav1d/src/picture.c:125:15
    #5 0x52cc04 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:155:9
    #6 0x550f03 in dav1d_submit_frame /src/dav1d/src/decode.c:3120:11
    #7 0x534b29 in dav1d_parse_obus /src/dav1d/src/obu.c:1411:24
    #8 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #9 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #10 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Indirect leak of 1664 byte(s) in 1 object(s) allocated from:
    #0 0x4ec488 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52ea3d in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52e942 in dav1d_ref_create /src/dav1d/src/ref.c:41:18
    #3 0x535434 in dav1d_parse_obus /src/dav1d/src/obu.c:1271:32
    #4 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #5 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #6 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Indirect leak of 1484 byte(s) in 1 object(s) allocated from:
    #0 0x4ec488 in __interceptor_posix_memalign _asan_rtl_
    #1 0x52ea3d in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x52e942 in dav1d_ref_create /src/dav1d/src/ref.c:41:18
    #3 0x534297 in dav1d_parse_obus /src/dav1d/src/obu.c:1232:25
    #4 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #5 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #6 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x4eb5ff in malloc _asan_rtl_
    #1 0x52cde9 in picture_alloc_with_edges /src/dav1d/src/picture.c:113:39
    #2 0x52cc04 in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:155:9
    #3 0x550f03 in dav1d_submit_frame /src/dav1d/src/decode.c:3120:11
    #4 0x534b29 in dav1d_parse_obus /src/dav1d/src/obu.c:1411:24
    #5 0x531d13 in dav1d_get_picture /src/dav1d/src/lib.c:318:20
    #6 0x52bffb in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #7 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #8 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #9 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #10 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #11 0x7fc6ffcc382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
SUMMARY: AddressSanitizer: 937332 byte(s) leaked in 7 allocation(s).

Input validation check 'dst->data[0] == ((void*)0)' failed in dav1d_picture_ref!
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f20ab9d3428 bp 0x7fff7836d6d0 sp 0x7fff7836d588 T0)
SCARINESS: 10 (signal)
    #0 0x7f20ab9d3427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54
    #1 0x7f20ab9d5029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
     #2 0x52d6f5 in dav1d_picture_ref /src/dav1d/src/picture.c:0
     #3 0x53217c in dav1d_get_picture /src/dav1d/src/lib.c:308:21
     #4 0x52c232 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:143:15
    #5 0x67e3b5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #6 0x653bdd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #7 0x65f426 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #8 0x65325c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #9 0x7f20ab9be82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #10 0x41c8a8 in _start

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

Thread 1 "dav1d_fuzzer" received signal SIGSEGV, Segmentation fault.
0x00007ffff7701877 in apply_to_row_y (out=0x7fffffffb230, in=0x62f000004470, grain_lut=0x7fffffff1140,
    scaling=0x7fffffff9e90 "", row_num=0) at ../src/film_grain_tmpl.c:282
282                     add_noise_y(x, y, grain);
(gdb) bt
    grain_lut=0x7fffffff1140, scaling=0x7fffffff9e90 "", row_num=0) at ../src/film_grain_tmpl.c:282
    at ../src/film_grain_tmpl.c:500
    at ../src/lib.c:267
    at ../tests/libfuzzer/dav1d_fuzzer.c:129
    at /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/Fuzz
erLoop.cpp:576
    at /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/Fuzz
erDriver.cpp:280
    at /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/Fuzz
erDriver.cpp:714
    at /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/Fuzz
erMain.cpp:20

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
     #0 0x5e6d97 in apply_to_row_y /src/dav1d/src/film_grain_tmpl.c:273:17
     #1 0x5e1d34 in dav1d_apply_grain_8bpc /src/dav1d/src/film_grain_tmpl.c:482:13
     #2 0x4ab9fa in output_image /src/dav1d/src/lib.c:262:9
    #3 0x4ab0aa in dav1d_get_picture /src/dav1d/src/lib.c:0
    #4 0x4a00de in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #5 0x6de50b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #6 0x6964b6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #7 0x6a72da in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #8 0x6955e1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #9 0x7f48fde2482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==19129==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7ffff76c7c44 in imax include/common/intops.h:36:12
    #1 0x7ffff76c0cb7 in selfguided_filter src/looprestoration_tmpl.c:444:32
    #2 0x7ffff76bdb5f in selfguided_c src/looprestoration_tmpl.c:558:9
    #3 0x7ffff76baae2 in lr_stripe src/lr_apply_tmpl.c:184:13
    #4 0x7ffff76b8f8b in lr_sbrow src/lr_apply_tmpl.c:261:13
    #5 0x7ffff76b6d22 in dav1d_lr_sbrow_16bpc src/lr_apply_tmpl.c:283:9
    #6 0x7ffff770fee3 in dav1d_filter_sbrow_16bpc src/recon_tmpl.c:1622:9
    #7 0x7ffff7411ab0 in dav1d_decode_frame src/decode.c:2841:25
    #8 0x7ffff7422fd3 in dav1d_submit_frame src/decode.c:3282:20
    #9 0x7ffff73ca2c0 in dav1d_parse_obus src/obu.c:1407:24
    #10 0x7ffff7735690 in dav1d_get_picture src/lib.c:318:20
    #11 0x4c7558 in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:129:19
    #12 0x42e182 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/FuzzerLoop.cpp:576:15
    #13 0x41fccd in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/FuzzerDriver.cpp:280:6
    #14 0x4248a2 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/FuzzerDriver.cpp:714:9
    #15 0x44d762 in main /var/tmp/portage/sys-libs/compiler-rt-sanitizers-7.0.0/work/compiler-rt-7.0.0.src/lib/fuzzer/FuzzerMain.cpp:20:10
    #16 0x7ffff6423e76 in __libc_start_main (/lib64/libc.so.6+0x21e76)

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

dav1d_fuzzer_mt: ../../src/dav1d/src/ipred_prepare_tmpl.c:88: enum IntraPredMode dav1d_prepare_intra_edges_16bpc(const int, const int, const int, const int, const int, const int, const enum EdgeFlags, const pixel *const, const ptrdiff_t, const pixel *, enum IntraPredMode, int *const, const int, const int, pixel *const): Assertion `y < h && x < w' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7ff09c0a9428 bp 0x000000795ea0 sp 0x7ff096776248 T3)
SCARINESS: 10 (signal)
dav1d_fuzzer_mt: ../../src/dav1d/src/ipred_prepare_tmpl.c:88: enum IntraPredMode dav1d_prepare_intra_edges_16bpc(const int, const int, const int, const int, const int, const int, const enum EdgeFlags, const pixel *const, const ptrdiff_t, const pixel *, enum IntraPredMode, int *const, const int, const int, pixel *const): Assertion `y < h && x < w' failed.
AddressSanitizer:DEADLYSIGNAL
    #0 0x7ff09c0a9427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54
    #1 0x7ff09c0ab029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
    #2 0x7ff09c0a1bd6 in __assert_fail_base /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:92
    #3 0x7ff09c0a1c81 in __assert_fail /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:101
    #4 0x64b1a3 in dav1d_prepare_intra_edges_16bpc /src/dav1d/src/ipred_prepare_tmpl.c:88:5
    #5 0x626c87 in dav1d_recon_b_intra_16bpc /src/dav1d/src/recon_tmpl.c:820:25
    #6 0x559de4 in decode_b /src/dav1d/src/decode.c:1162:13
    #7 0x544f5c in decode_sb /src/dav1d/src/decode.c:1957:17
    #8 0x5439eb in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #9 0x5339c6 in dav1d_tile_task /src/dav1d/src/thread_task.c:125:25
    #10 0x7ff09cd706b9 in start_thread

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x00000000001c (pc 0x7f0f94103ec2 bp 0x7fff324b9e10 sp 0x7fff324b9d18 T1)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x7f0f94103ec1 in memcpy-avx-unaligned.S:50 /build/glibc-Cl5G7W/glibc-2.23/sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:50
    #1 0x439e62 in parse_frame_hdr /src/dav1d/src/obu.c:1044:78
    #2 0x4341b3 in dav1d_parse_obus /src/dav1d/src/obu.c:1274:20
    #3 0x4322ae in dav1d_get_picture /src/dav1d/src/lib.c:317:20
    #4 0x42f182 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:129:19
    #5 0x503ef8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #6 0x4f4512 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #7 0x4f818b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #8 0x4f4298 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #9 0x7f0f93fd682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #10 0x405cd8 in _start

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5a2c04 in iclip /src/dav1d/include/common/intops.h:44:28
    #1 0x5a3ee1 in put_8tap_scaled_c /src/dav1d/src/mc_tmpl.c:0
    #2 0x597b07 in put_8tap_smooth_scaled_c /src/dav1d/src/mc_tmpl.c:330:1
    #3 0x5d71c7 in mc /src/dav1d/src/recon_tmpl.c:593:13
    #4 0x5cf67d in dav1d_recon_b_inter_8bpc /src/dav1d/src/recon_tmpl.c:1299:27
    #5 0x501f0f in decode_b /src/dav1d/src/decode.c:1827:17
    #6 0x4ccced in decode_sb /src/dav1d/src/decode.c:1961:17
    #7 0x4cd802 in decode_sb /src/dav1d/src/decode.c:2005:21
    #8 0x4cd802 in decode_sb /src/dav1d/src/decode.c:2005:21
    #9 0x4cd802 in decode_sb /src/dav1d/src/decode.c:2005:21
    #10 0x4c9833 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2469:13
    #11 0x4ad905 in dav1d_tile_task /src/dav1d/src/thread_task.c:125:25
    #12 0x49f1ae in __msan::MsanThread::ThreadStart() /src/llvm/projects/compiler-rt/lib/msan/msan_thread.cc:77

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000010 (pc 0x00000043665f bp 0x7fff587b6710 sp 0x7fff587b6640 T1)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
    #0 0x43665e in parse_frame_hdr /src/dav1d/src/obu.c:464:49
    #1 0x434120 in dav1d_parse_obus /src/dav1d/src/obu.c:1271:20
    #2 0x43222e in dav1d_get_picture /src/dav1d/src/lib.c:317:20
    #3 0x42f167 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #4 0x503eb8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #5 0x4f44d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #6 0x4f814b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #7 0x4f4258 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #8 0x7fa36446682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #9 0x405cd8 in _start

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x6722a4 in iclip /src/dav1d/include/common/intops.h:44:12
    #1 0x6694f0 in generate_grain_y /src/dav1d/src/film_grain_tmpl.c:105:25
    #2 0x667d8c in dav1d_apply_grain_10bpc /src/dav1d/src/film_grain_tmpl.c:486:5
    #3 0x4ab6b8 in output_image /src/dav1d/src/lib.c:266:9
    #4 0x4aacda in dav1d_get_picture /src/dav1d/src/lib.c:0
    #5 0x4a0259 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:131:15
    #6 0x6ddf1b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x695ec6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x6a6cea in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x694ff1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7f0de309882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #11 0x41e8e8 in _start
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a5019 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a4e69 in dav1d_ref_create /src/dav1d/src/ref.c:41:18
    #3 0x4b00c9 in dav1d_parse_obus /src/dav1d/src/obu.c:1265:32
    #4 0x4aa30f in dav1d_get_picture /src/dav1d/src/lib.c:317:20
    #5 0x49ffda in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #6 0x6ddf1b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x695ec6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x6a6cea in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x694ff1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7f0de309882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

dav1d_fuzzer_mt: ../../src/dav1d/src/msac.c:79: unsigned int msac_decode_symbol(MsacContext *const, const uint16_t *const, const unsigned int): Assertion `!cdf[n_symbols - 1]' failed.
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==1==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f797c702428 bp 0x0000005b05eb sp 0x7f797a247a88 T12)
    #0 0x7f797c702427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54
    #1 0x7f797c704029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
    #2 0x7f797c6fabd6 in __assert_fail_base /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:92
    #3 0x7f797c6fac81 in __assert_fail /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:101
    #4 0x45f047 in msac_decode_symbol /src/dav1d/src/msac.c:79:5
    #5 0x45fadd in msac_decode_symbol_adapt /src/dav1d/src/msac.c:159:26
    #6 0x43c3ce in decode_sb /src/dav1d/src/decode.c:1940:18
    #7 0x43b664 in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2464:13
    #8 0x432d6e in dav1d_tile_task /src/dav1d/src/thread_task.c:89:29
    #9 0x7f797d3c96b9 in start_thread

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x59bbd4 in iclip /src/dav1d/include/common/intops.h:44:28
    #1 0x599267 in resize_c /src/dav1d/src/mc_tmpl.c:794:22
    #2 0x6797e1 in backup_lpf /src/dav1d/src/lr_apply_tmpl.c:77:13
    #3 0x6787aa in dav1d_lr_copy_lpf_8bpc /src/dav1d/src/lr_apply_tmpl.c:115:9
    #4 0x5d4247 in dav1d_filter_sbrow_8bpc /src/dav1d/src/recon_tmpl.c:1584:9
    #5 0x4d579e in dav1d_decode_frame /src/dav1d/src/decode.c:2830:25
    #6 0x4de348 in dav1d_submit_frame /src/dav1d/src/decode.c:3271:20
    #7 0x4adb6e in dav1d_parse_obus /src/dav1d/src/obu.c:1314:20
    #8 0x4a7c1a in dav1d_get_picture /src/dav1d/src/lib.c:271:20
    #9 0x49ffcc in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #10 0x6d646b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x68e416 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x69f23a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x68d541 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7f79941b682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #15 0x41e8e8 in _start

Use with `meson test --setup=sanitizer`, multiplies the timeouts by 3.

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

Discovered by apply_to_row_y().
==1==ERROR: UndefinedBehaviorSanitizer: stack-overflow on address 0x7ffc5e8ea0a1 (pc 0x0000004e362c bp 0x7ffc5e8daef0 sp 0x7ffc5e8dadc0 T1)
    #0 0x4e362b in apply_to_row_y /src/dav1d/src/film_grain_tmpl.c:283:17
    #1 0x4e1d0a in dav1d_apply_grain_10bpc /src/dav1d/src/film_grain_tmpl.c:504:13
    #2 0x431a14 in output_image /src/dav1d/src/lib.c:199:9
    #3 0x431864 in dav1d_get_picture /src/dav1d/src/lib.c:0
    #4 0x42f252 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:131:15
    #5 0x502a88 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #6 0x501e55 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:480:3
    #7 0x5044a7 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:783:7
    #8 0x504845 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:806:3
    #9 0x4f6f3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6
    #10 0x4f2e28 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #11 0x7f2438c2c82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #12 0x405cd8 in _start
SUMMARY: UndefinedBehaviorSanitizer: stack-overflow (/mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_dav1d_1dba850c6be01aadc39811634b000cc38db48773/revisions/dav1d_fuzzer_mt+0x4e362b)

Janne Grunau authored 6 years ago and Janne Grunau committed 6 years ago

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5e2f34 in iclip /src/dav1d/include/common/intops.h:44:12
    #1 0x5e027e in apply_to_row_uv /src/dav1d/src/film_grain_tmpl.c:431:17
    #2 0x5d9647 in dav1d_apply_grain_8bpc /src/dav1d/src/film_grain_tmpl.c:507:13
    #3 0x4a89e3 in output_image /src/dav1d/src/lib.c:197:9
    #4 0x4a8345 in dav1d_get_picture /src/dav1d/src/lib.c:0
    #5 0x49ffa7 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #6 0x6d552b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #7 0x68d4d6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #8 0x69e2fa in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #9 0x68c601 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #10 0x7f5e5cd2082f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #11 0x41e8e8 in _start
  Uninitialized value was created by a heap allocation
    #0 0x46bd54 in __interceptor_posix_memalign /src/llvm/projects/compiler-rt/lib/msan/msan_interceptors.cc:170
    #1 0x4a1119 in dav1d_alloc_aligned /src/dav1d/include/common/mem.h:46:9
    #2 0x4a0ba8 in default_picture_allocator /src/dav1d/src/picture.c:59:21
    #3 0x4a0623 in fuzz_picture_allocator /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:52:12
    #4 0x4a1a57 in picture_alloc_with_edges /src/dav1d/src/picture.c:130:15
    #5 0x4a14df in dav1d_thread_picture_alloc /src/dav1d/src/picture.c:162:9
    #6 0x4db033 in dav1d_submit_frame /src/dav1d/src/decode.c:3098:11
    #7 0x4ad743 in dav1d_parse_obus /src/dav1d/src/obu.c:1292:20
    #8 0x4a7994 in dav1d_get_picture /src/dav1d/src/lib.c:251:20
    #9 0x49ffa7 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #10 0x6d552b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x68d4d6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x69e2fa in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x68c601 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7f5e5cd2082f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_dav1d_3cefbaa25c2c6bbdc887bbe62141145645bd0466/revisions/dav1d_fuzzer+0x5e2f34)