From 4ab2109685ea363c1faacd03676c4c5a9ec43756 Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Thu, 21 Jul 2022 11:17:42 -0700
Subject: [PATCH] avc_dec_fuzzer: Zero initialize input and output structures
 to API calls

Input and output structures to decoder's functions are now zero
initialized. This way any new additional members in these structures
will be initialized correctly.

Bug: oss-fuzz:49322
Bug: 175179303
Test: avc_dec_fuzzer with memory sanitizer
Change-Id: Ic89625aaaededdef107c34bf8bdc793824b96f85
---
 fuzzer/avc_dec_fuzzer.cpp | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/fuzzer/avc_dec_fuzzer.cpp b/fuzzer/avc_dec_fuzzer.cpp
index c292298..4e0876e 100644
--- a/fuzzer/avc_dec_fuzzer.cpp
+++ b/fuzzer/avc_dec_fuzzer.cpp
@@ -109,8 +109,8 @@ Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) {
 Codec::~Codec() {}
 void Codec::createCodec() {
   IV_API_CALL_STATUS_T ret;
-  ih264d_create_ip_t create_ip;
-  ih264d_create_op_t create_op;
+  ih264d_create_ip_t create_ip{};
+  ih264d_create_op_t create_op{};
   void *fxns = (void *)&ivd_api_function;
 
   create_ip.s_ivd_create_ip_t.e_cmd = IVD_CMD_CREATE;
@@ -132,8 +132,8 @@ void Codec::createCodec() {
 }
 
 void Codec::deleteCodec() {
-  ivd_delete_ip_t delete_ip;
-  ivd_delete_op_t delete_op;
+  ivd_delete_ip_t delete_ip{};
+  ivd_delete_op_t delete_op{};
 
   delete_ip.e_cmd = IVD_CMD_DELETE;
   delete_ip.u4_size = sizeof(ivd_delete_ip_t);
@@ -142,8 +142,8 @@ void Codec::deleteCodec() {
   ivd_api_function(mCodec, (void *)&delete_ip, (void *)&delete_op);
 }
 void Codec::resetCodec() {
-  ivd_ctl_reset_ip_t s_ctl_ip;
-  ivd_ctl_reset_op_t s_ctl_op;
+  ivd_ctl_reset_ip_t s_ctl_ip{};
+  ivd_ctl_reset_op_t s_ctl_op{};
 
   s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
   s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET;
@@ -154,8 +154,8 @@ void Codec::resetCodec() {
 }
 
 void Codec::setCores() {
-  ih264d_ctl_set_num_cores_ip_t s_ctl_ip;
-  ih264d_ctl_set_num_cores_op_t s_ctl_op;
+  ih264d_ctl_set_num_cores_ip_t s_ctl_ip{};
+  ih264d_ctl_set_num_cores_op_t s_ctl_op{};
 
   s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
   s_ctl_ip.e_sub_cmd =
@@ -168,8 +168,8 @@ void Codec::setCores() {
 }
 
 void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) {
-  ivd_ctl_set_config_ip_t s_ctl_ip;
-  ivd_ctl_set_config_op_t s_ctl_op;
+  ivd_ctl_set_config_ip_t s_ctl_ip{};
+  ivd_ctl_set_config_op_t s_ctl_op{};
 
   s_ctl_ip.u4_disp_wd = 0;
   s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE;
@@ -184,8 +184,8 @@ void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) {
 }
 
 void Codec::setArchitecture(IVD_ARCH_T arch) {
-  ih264d_ctl_set_processor_ip_t s_ctl_ip;
-  ih264d_ctl_set_processor_op_t s_ctl_op;
+  ih264d_ctl_set_processor_ip_t s_ctl_ip{};
+  ih264d_ctl_set_processor_op_t s_ctl_op{};
 
   s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
   s_ctl_ip.e_sub_cmd =
@@ -253,13 +253,10 @@ void Codec::decodeHeader(const uint8_t *data, size_t size) {
 
   while (size > 0) {
     IV_API_CALL_STATUS_T ret;
-    ivd_video_decode_ip_t dec_ip;
-    ivd_video_decode_op_t dec_op;
+    ivd_video_decode_ip_t dec_ip{};
+    ivd_video_decode_op_t dec_op{};
     size_t bytes_consumed;
 
-    memset(&dec_ip, 0, sizeof(dec_ip));
-    memset(&dec_op, 0, sizeof(dec_op));
-
     dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
     dec_ip.u4_ts = 0;
     dec_ip.pv_stream_buffer = (void *)data;
@@ -295,11 +292,8 @@ void Codec::decodeHeader(const uint8_t *data, size_t size) {
 IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size,
                                         size_t *bytesConsumed) {
   IV_API_CALL_STATUS_T ret;
-  ivd_video_decode_ip_t dec_ip;
-  ivd_video_decode_op_t dec_op;
-
-  memset(&dec_ip, 0, sizeof(dec_ip));
-  memset(&dec_op, 0, sizeof(dec_op));
+  ivd_video_decode_ip_t dec_ip{};
+  ivd_video_decode_op_t dec_op{};
 
   dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
   dec_ip.u4_ts = 0;