diff options
| author | Marco Nelissen <marcone@google.com> | 2015-04-30 13:45:34 -0700 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-19 02:03:28 +0200 |
| commit | 2adc45f2616bd8b2f81e333f76ade66b62d38fd8 (patch) | |
| tree | 73afd0d16256ef76cc0c149f80a74fb78e96a549 | |
| parent | 0982810d2495eb7c6e79e46db19a6e5ea41bc7ba (diff) | |
| download | external_tremolo-2adc45f2616bd8b2f81e333f76ade66b62d38fd8.zip external_tremolo-2adc45f2616bd8b2f81e333f76ade66b62d38fd8.tar.gz external_tremolo-2adc45f2616bd8b2f81e333f76ade66b62d38fd8.tar.bz2 | |
Fix allocation failure crash
Bug: 20718524
Change-Id: I86dcaf7d7452ad892822ff96fbcc0908e035b118
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
| -rw-r--r-- | Tremolo/codebook.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c index 329c3c1..0b596ee 100644 --- a/Tremolo/codebook.c +++ b/Tremolo/codebook.c @@ -502,13 +502,12 @@ int vorbis_book_unpack(oggpack_buffer *opb,codebook *s){ /* use dec_type 1: vector of packed values */ /* need quantized values before */ - s->q_val=alloca(sizeof(ogg_uint16_t)*quantvals); + s->q_val=calloc(sizeof(ogg_uint16_t), quantvals); if (!s->q_val) goto _eofout; for(i=0;i<quantvals;i++) ((ogg_uint16_t *)s->q_val)[i]=(ogg_uint16_t)oggpack_read(opb,s->q_bits); if(oggpack_eop(opb)){ - s->q_val=0; /* cleanup must not free alloca memory */ goto _eofout; } @@ -518,12 +517,11 @@ int vorbis_book_unpack(oggpack_buffer *opb,codebook *s){ s->dec_leafw=_determine_leaf_words(s->dec_nodeb, (s->q_bits*s->dim+8)/8); if(_make_decode_table(s,lengthlist,quantvals,opb,maptype)){ - s->q_val=0; /* cleanup must not free alloca memory */ goto _errout; } - s->q_val=0; /* about to go out of scope; _make_decode_table - was using it */ + free(s->q_val); + s->q_val=0; }else{ /* use dec_type 2: packed vector of column offsets */ @@ -612,6 +610,8 @@ int vorbis_book_unpack(oggpack_buffer *opb,codebook *s){ _errout: _eofout: vorbis_book_clear(s); + free(lengthlist); + free(s->q_val); return -1; } |