Revert to zero-initializing buffers for FFmpegVideoDecoder

media/filters/ffmpeg_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/ffmpeg_video_decoder.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 97 matching lines @@
   // since we don't use this, just DCHECK that it's zero.
   DCHECK_EQ(codec_context->lowres, 0);
   gfx::Size coded_size(std::max(size.width(), codec_context->coded_width),
                        std::max(size.height(), codec_context->coded_height));
 
   if (!VideoFrame::IsValidConfig(format, VideoFrame::STORAGE_UNKNOWN,
                                  coded_size, gfx::Rect(size), natural_size)) {
     return AVERROR(EINVAL);
   }
 
+  // FFmpeg expects the initialize allocation to be zero-initialized.  Failure
+  // to do so can lead to unitialized value usage.  See http://crbug.com/390941
   scoped_refptr<VideoFrame> video_frame = frame_pool_.CreateFrame(
       format, coded_size, gfx::Rect(size), natural_size, kNoTimestamp());
-#if defined(MEMORY_SANITIZER)
-  MSAN_UNPOISON(video_frame->data(0),
-                VideoFrame::AllocationSize(format, coded_size));
-#endif
 
   // Prefer the color space from the codec context. If it's not specified (or is
   // set to an unsupported value), fall back on the value from the config.
   ColorSpace color_space = AVColorSpaceToColorSpace(codec_context->colorspace,
                                                     codec_context->color_range);
   if (color_space == COLOR_SPACE_UNSPECIFIED)
     color_space = config_.color_space();
   video_frame->metadata()->SetInteger(VideoFrameMetadata::COLOR_SPACE,
                                       color_space);
 
-  for (int i = 0; i < 3; i++) {
+  for (size_t i = 0; i < VideoFrame::NumPlanes(video_frame->format()); i++) {
     frame->data[i] = video_frame->data(i);
     frame->linesize[i] = video_frame->stride(i);
   }
 
   frame->width = coded_size.width();
   frame->height = coded_size.height();
   frame->format = codec_context->pix_fmt;
   frame->reordered_opaque = codec_context->reordered_opaque;
 
   // Now create an AVBufferRef for the data just allocated. It will own the
@@ skipping 207 matching lines @@
   if (!codec || avcodec_open2(codec_context_.get(), codec, NULL) < 0) {
     ReleaseFFmpegResources();
     return false;
   }
 
   av_frame_.reset(av_frame_alloc());
   return true;
 }
 
 }  // namespace media