oss-fuzz: Assertion 'seg_id < 8' failed in get_prev_frame_segid() src/decode.c:664
Reproduced with commit 46e2a2d0
Steps to reproduce:
- build dav1d with -Dbuildtype=debugoptimized
- replay testcase with
./dav1d_fuzzer clusterfuzz-testcase-minimized-dav1d_fuzzer-5740590025670656
clusterfuzz-testcase-minimized-dav1d_fuzzer-5740590025670656
dav1d_fuzzer: src/decode.c:664: unsigned int get_prev_frame_segid(const Dav1dFrameContext *const, const int, const int, const int, int, const uint8_t *, const ptrdiff_t): Assertion `seg_id < 8' failed.
==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f5f33c3d428 bp 0x0000006862c0 sp 0x7fff8e2c04c8 T0)
SCARINESS: 10 (signal)
#0 0x7f5f33c3d427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54
#1 0x7f5f33c3f029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
#2 0x7f5f33c35bd6 in __assert_fail_base /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:92
#3 0x7f5f33c35c81 in __assert_fail /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:101
#4 0x55f3c9 in get_prev_frame_segid src/decode.c:664:5
#5 0x551f31 in decode_b src/decode.c:761:29
#6 0x54610b in decode_sb src/decode.c:2080:17
#7 0x544ebf in dav1d_decode_tile_sbrow src/decode.c:2323:13
#8 0x54b691 in dav1d_decode_frame src/decode.c:2668:29
#9 0x55088e in dav1d_submit_frame src/decode.c:3041:20
#10 0x5384ef in dav1d_parse_obus src/obu.c:1110:20
#11 0x5356a6 in dav1d_decode src/lib.c:201:20
#12 0x53209b in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:82:19