Remove memset from VideoFrame and mark buffer as unpoisoned

media/filters/ffmpeg_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/ffmpeg_video_decoder.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 107 matching lines @@
   DCHECK_EQ(codec_context->lowres, 0);
   gfx::Size coded_size(
       RoundUp(std::max(size.width(), codec_context->coded_width), 2),
       RoundUp(std::max(size.height(), codec_context->coded_height), 2));
 
   if (!VideoFrame::IsValidConfig(format, VideoFrame::STORAGE_UNKNOWN,
                                  coded_size, gfx::Rect(size), natural_size)) {
     return AVERROR(EINVAL);
   }
 
+  // FFmpeg expects the initialize allocation to be zero-initialized.  Failure
+  // to do so can lead to unitialized value usage.  See http://crbug.com/390941
   scoped_refptr<VideoFrame> video_frame = frame_pool_.CreateFrame(
-      format, coded_size, gfx::Rect(size), natural_size, kNoTimestamp());
+      format, coded_size, gfx::Rect(size), natural_size, kNoTimestamp(), true);
+
   if (codec_context->colorspace == AVCOL_SPC_BT709) {
     video_frame->metadata()->SetInteger(VideoFrameMetadata::COLOR_SPACE,
                                         VideoFrame::COLOR_SPACE_HD_REC709);
   }
 
-  for (int i = 0; i < 3; i++) {
+  for (size_t i = 0; i < VideoFrame::NumPlanes(video_frame->format()); i++) {
     frame->data[i] = video_frame->data(i);
     frame->linesize[i] = video_frame->stride(i);
   }
 
   frame->width = coded_size.width();
   frame->height = coded_size.height();
   frame->format = codec_context->pix_fmt;
   frame->reordered_opaque = codec_context->reordered_opaque;
 
   // Now create an AVBufferRef for the data just allocated. It will own the
   // reference to the VideoFrame object.
   void* opaque = NULL;
   video_frame.swap(reinterpret_cast<VideoFrame**>(&opaque));
   frame->buf[0] =
       av_buffer_create(frame->data[0],
-                       VideoFrame::AllocationSize(format, coded_size),
+                       VideoFrame::AlignedAllocationSize(video_frame),
                        ReleaseVideoBufferImpl,
                        opaque,
                        0);
   return 0;
 }
 
 std::string FFmpegVideoDecoder::GetDisplayName() const {
   return "FFmpegVideoDecoder";
 }
 
@@ skipping 191 matching lines @@
   if (!codec || avcodec_open2(codec_context_.get(), codec, NULL) < 0) {
     ReleaseFFmpegResources();
     return false;
   }
 
   av_frame_.reset(av_frame_alloc());
   return true;
 }
 
 }  // namespace media