[FFmpeg-cvslog] avcodec/pafvideo: Only clear frame when it was written to

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Tue Aug  6 23:07:01 2019 +0200| [859362a6f01dabaf28f189e395724c89b1e89ffd] | committer: Michael Niedermayer

avcodec/pafvideo: Only clear frame when it was written to

This avoids unneeded operations and makes the code faster.

Fixes: Timeout
Fixes: 15724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5750842205929472 (12sec -> 9sec)
Fixes: 17625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5640515311108096 (16sec -> 4sec)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=859362a6f01dabaf28f189e395724c89b1e89ffd
---

 libavcodec/pafvideo.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/pafvideo.c b/libavcodec/pafvideo.c
index 6b4771cbce..07fa05caf8 100644
--- a/libavcodec/pafvideo.c
+++ b/libavcodec/pafvideo.c
@@ -55,6 +55,7 @@ typedef struct PAFVideoDecContext {
 
     int current_frame;
     uint8_t *frame[4];
+    int dirty[4];
     int frame_size;
     int video_size;
 
@@ -187,6 +188,7 @@ static int decode_0(PAFVideoDecContext *c, uint8_t *pkt, uint8_t code)
             j      = bytestream2_get_le16(&c->gb) + offset;
             if (bytestream2_get_bytes_left(&c->gb) < (j - offset) * 16)
                 return AVERROR_INVALIDDATA;
+            c->dirty[page] = 1;
             do {
                 offset++;
                 if (dst + 3 * c->width + 4 > dend)
@@ -329,9 +331,13 @@ static int paf_video_decode(AVCodecContext *avctx, void *data,
         c->pic->palette_has_changed = 1;
     }
 
+    c->dirty[c->current_frame] = 1;
     if (code & 0x20)
-        for (i = 0; i < 4; i++)
-            memset(c->frame[i], 0, c->frame_size);
+        for (i = 0; i < 4; i++) {
+            if (c->dirty[i])
+                memset(c->frame[i], 0, c->frame_size);
+            c->dirty[i] = 0;
+        }
 
     switch (code & 0x0F) {
     case 0: