diff options
author | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
---|---|---|
committer | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
commit | 28854b5669212379c190640063be53b19f12ab88 (patch) | |
tree | 01f5b70ac3c76888b59b10c8f446fbc576845166 /info.c | |
parent | ba51e86cb277cea805ddc2506b63d01ddd919763 (diff) | |
download | tremor-28854b5669212379c190640063be53b19f12ab88.tar.gz |
Port the rest of r16222 from libvorbis.
Commit additional hardening to setup packet decode.
git-svn-id: https://svn.xiph.org/trunk/Tremor@17525 0101bb08-14d6-0310-b084-bc0e0c8e3800
Diffstat (limited to 'info.c')
-rw-r--r-- | info.c | 17 |
1 files changed, 7 insertions, 10 deletions
@@ -231,7 +231,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* codebooks */ ci->books=oggpack_read(opb,8)+1; - /*ci->book_param=_ogg_calloc(ci->books,sizeof(*ci->book_param));*/ + if(ci->books<=0)goto err_out; for(i=0;i<ci->books;i++){ ci->book_param[i]=(static_codebook *)_ogg_calloc(1,sizeof(*ci->book_param[i])); if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out; @@ -239,8 +239,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* time backend settings */ ci->times=oggpack_read(opb,6)+1; - /*ci->time_type=_ogg_malloc(ci->times*sizeof(*ci->time_type));*/ - /*ci->time_param=_ogg_calloc(ci->times,sizeof(void *));*/ + if(ci->times<=0)goto err_out; for(i=0;i<ci->times;i++){ ci->time_type[i]=oggpack_read(opb,16); if(ci->time_type[i]<0 || ci->time_type[i]>=VI_TIMEB)goto err_out; @@ -251,8 +250,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* floor backend settings */ ci->floors=oggpack_read(opb,6)+1; - /*ci->floor_type=_ogg_malloc(ci->floors*sizeof(*ci->floor_type));*/ - /*ci->floor_param=_ogg_calloc(ci->floors,sizeof(void *));*/ + if(ci->floors<=0)goto err_out; for(i=0;i<ci->floors;i++){ ci->floor_type[i]=oggpack_read(opb,16); if(ci->floor_type[i]<0 || ci->floor_type[i]>=VI_FLOORB)goto err_out; @@ -262,8 +260,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* residue backend settings */ ci->residues=oggpack_read(opb,6)+1; - /*ci->residue_type=_ogg_malloc(ci->residues*sizeof(*ci->residue_type));*/ - /*ci->residue_param=_ogg_calloc(ci->residues,sizeof(void *));*/ + if(ci->residues<=0)goto err_out; for(i=0;i<ci->residues;i++){ ci->residue_type[i]=oggpack_read(opb,16); if(ci->residue_type[i]<0 || ci->residue_type[i]>=VI_RESB)goto err_out; @@ -273,8 +270,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* map backend settings */ ci->maps=oggpack_read(opb,6)+1; - /*ci->map_type=_ogg_malloc(ci->maps*sizeof(*ci->map_type));*/ - /*ci->map_param=_ogg_calloc(ci->maps,sizeof(void *));*/ + if(ci->maps<=0)goto err_out; for(i=0;i<ci->maps;i++){ ci->map_type[i]=oggpack_read(opb,16); if(ci->map_type[i]<0 || ci->map_type[i]>=VI_MAPB)goto err_out; @@ -284,7 +280,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* mode settings */ ci->modes=oggpack_read(opb,6)+1; - /*vi->mode_param=_ogg_calloc(vi->modes,sizeof(void *));*/ + if(ci->modes<=0)goto err_out; for(i=0;i<ci->modes;i++){ ci->mode_param[i]=(vorbis_info_mode *)_ogg_calloc(1,sizeof(*ci->mode_param[i])); ci->mode_param[i]->blockflag=oggpack_read(opb,1); @@ -295,6 +291,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ if(ci->mode_param[i]->windowtype>=VI_WINDOWB)goto err_out; if(ci->mode_param[i]->transformtype>=VI_WINDOWB)goto err_out; if(ci->mode_param[i]->mapping>=ci->maps)goto err_out; + if(ci->mode_param[i]->mapping<0)goto err_out; } if(oggpack_read(opb,1)!=1)goto err_out; /* top level EOP check */ |