Zero initialize the first allocation of a VideoFrame.

media/base/video_frame.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/base/video_frame.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 600 matching lines @@
           ? y_height / 2
           : y_height;
   size_t y_bytes = y_height * y_stride;
   size_t uv_bytes = uv_height * uv_stride;
   size_t a_bytes = format_ == VideoFrame::YV12A ? y_bytes : 0;
 
   // The extra line of UV being allocated is because h264 chroma MC
   // overreads by one line in some cases, see libavcodec/utils.c:
   // avcodec_align_dimensions2() and libavcodec/x86/h264_chromamc.asm:
   // put_h264_chroma_mc4_ssse3().
+  const size_t data_size =
+      y_bytes + (uv_bytes * 2 + uv_stride) + a_bytes + kFrameSizePadding;
   uint8* data = reinterpret_cast<uint8*>(
-      base::AlignedAlloc(
-          y_bytes + (uv_bytes * 2 + uv_stride) + a_bytes + kFrameSizePadding,
-          kFrameAddressAlignment));
+      base::AlignedAlloc(data_size, kFrameAddressAlignment));
+  // FFmpeg expects the initialize allocation to be zero-initialized.  Failure
+  // to do so can lead to unitialized value usage.  See http://crbug.com/390941
+  memset(data, 0, data_size);
   no_longer_needed_cb_ = base::Bind(&ReleaseData, data);
   COMPILE_ASSERT(0 == VideoFrame::kYPlane, y_plane_data_must_be_index_0);
   data_[VideoFrame::kYPlane] = data;
   data_[VideoFrame::kUPlane] = data + y_bytes;
   data_[VideoFrame::kVPlane] = data + y_bytes + uv_bytes;
   strides_[VideoFrame::kYPlane] = y_stride;
   strides_[VideoFrame::kUPlane] = uv_stride;
   strides_[VideoFrame::kVPlane] = uv_stride;
   if (format_ == YV12A) {
     data_[VideoFrame::kAPlane] = data + y_bytes + (2 * uv_bytes);
@@ skipping 201 matching lines @@
       break;
     for (int row = 0; row < rows(plane); ++row) {
       base::MD5Update(context, base::StringPiece(
           reinterpret_cast<char*>(data(plane) + stride(plane) * row),
           row_bytes(plane)));
     }
   }
 }
 
 }  // namespace media