vp8_de_alloc_frame_buffers: clear mi/postproc_state

This avoids leaving the decoder in an inconsistent state, which can lead
to a use-after-free (UAF) through `VP8_COMMON::mi`,
`VP8_COMMON::frame_to_show`, and `VP8_COMMON::postproc_state` with
`VP8_MFQE` enabled when decoding proceeds after an earlier allocation
failure.

Bug: 500638476
Change-Id: I0adb05c63db897093df2aa283b51888543a107ea

Author: jan-ivar

vp8/common/alloccommon.c

@@ -17,6 +17,8 @@
 #include "entropymode.h"
 #include "systemdependent.h"
 
+// This function frees all frame and post processing buffers, as well as
+// indirect references to them via context and mode info allocations.
 void vp8_de_alloc_frame_buffers(VP8_COMMON *oci) {
   int i;
   for (i = 0; i < NUM_YV12_BUFFERS; ++i) {
@@ -34,18 +36,22 @@ void vp8_de_alloc_frame_buffers(VP8_COMMON *oci) {
   oci->pp_limits_buffer = NULL;
 
   vpx_free(oci->postproc_state.generated_noise);
-  oci->postproc_state.generated_noise = NULL;
+  memset(&oci->postproc_state, 0, sizeof(oci->postproc_state));
 #endif
 
   vpx_free(oci->above_context);
   vpx_free(oci->mip);
 #if CONFIG_ERROR_CONCEALMENT
   vpx_free(oci->prev_mip);
   oci->prev_mip = NULL;
+  oci->prev_mi = NULL;
 #endif
 
   oci->above_context = NULL;
   oci->mip = NULL;
+  oci->mi = NULL;
+  oci->show_frame_mi = NULL;
+  oci->frame_to_show = NULL;
 }
 
 int vp8_alloc_frame_buffers(VP8_COMMON *oci, int width, int height) {