Add a loop to drain buffered frames in the decoder

If we use a single decoder instance to decode all tiles in an image
grid, it is important to endure there are no buffered frames in the
decoder before decoding the next tile with the decoder.

BUG=oss-fuzz:66313

src/codec_dav1d.c

@@ -88,16 +88,17 @@ static avifBool dav1dCodecGetNextImage(struct avifCodec * codec,
         return AVIF_FALSE;
     }
 
+    int res;
     for (;;) {
         if (dav1dData.data) {
-            int res = dav1d_send_data(codec->internal->dav1dContext, &dav1dData);
+            res = dav1d_send_data(codec->internal->dav1dContext, &dav1dData);
             if ((res < 0) && (res != DAV1D_ERR(EAGAIN))) {
                 dav1d_data_unref(&dav1dData);
                 return AVIF_FALSE;
             }
         }
 
-        int res = dav1d_get_picture(codec->internal->dav1dContext, &nextFrame);
+        res = dav1d_get_picture(codec->internal->dav1dContext, &nextFrame);
         if (res == DAV1D_ERR(EAGAIN)) {
             if (dav1dData.data) {
                 // send more data
@@ -125,6 +126,23 @@ static avifBool dav1dCodecGetNextImage(struct avifCodec * codec,
         dav1d_data_unref(&dav1dData);
     }
 
+    // Drain all buffered frames in the decoder.
+    do {
+        Dav1dPicture frame;
+        memset(&frame, 0, sizeof(Dav1dPicture));
+        res = dav1d_get_picture(codec->internal->dav1dContext, &frame);
+        if (res < 0) {
+            if (res != DAV1D_ERR(EAGAIN)) {
+                if (gotPicture) {
+                    dav1d_picture_unref(&nextFrame);
+                }
+                return AVIF_FALSE;
+            }
+        } else {
+            dav1d_picture_unref(&frame);
+        }
+    } while (res == 0);
+
     if (gotPicture) {
         dav1d_picture_unref(&codec->internal->dav1dPicture);
         codec->internal->dav1dPicture = nextFrame;