diff options
author | Nils Wallménius <nils@rockbox.org> | 2010-12-07 16:55:36 +0000 |
---|---|---|
committer | Nils Wallménius <nils@rockbox.org> | 2010-12-07 16:55:36 +0000 |
commit | 1930e9f4baee8086195e147b9580ebbf3042b3cc (patch) | |
tree | 5f8497aa24b0eaa61ff0b6d95c42f694c57459bd /apps/codecs/libtremor/info.c | |
parent | 02f836b1b2ab2fd827be950b1f41cdbed1572c5a (diff) | |
download | rockbox-1930e9f4baee8086195e147b9580ebbf3042b3cc.tar.gz rockbox-1930e9f4baee8086195e147b9580ebbf3042b3cc.zip |
libtremor: merge upstream revision 17525 'Commit additional hardening to setup packet decode.'
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@28762 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/codecs/libtremor/info.c')
-rw-r--r-- | apps/codecs/libtremor/info.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/apps/codecs/libtremor/info.c b/apps/codecs/libtremor/info.c index 7c9af7ccdb..b819570682 100644 --- a/apps/codecs/libtremor/info.c +++ b/apps/codecs/libtremor/info.c | |||
@@ -166,7 +166,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
166 | 166 | ||
167 | /* codebooks */ | 167 | /* codebooks */ |
168 | ci->books=oggpack_read(opb,8)+1; | 168 | ci->books=oggpack_read(opb,8)+1; |
169 | /*ci->book_param=_ogg_calloc(ci->books,sizeof(*ci->book_param));*/ | 169 | if(ci->books<=0)goto err_out; |
170 | for(i=0;i<ci->books;i++){ | 170 | for(i=0;i<ci->books;i++){ |
171 | ci->book_param[i]=(static_codebook *)_ogg_calloc(1,sizeof(*ci->book_param[i])); | 171 | ci->book_param[i]=(static_codebook *)_ogg_calloc(1,sizeof(*ci->book_param[i])); |
172 | if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out; | 172 | if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out; |
@@ -174,8 +174,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
174 | 174 | ||
175 | /* time backend settings */ | 175 | /* time backend settings */ |
176 | ci->times=oggpack_read(opb,6)+1; | 176 | ci->times=oggpack_read(opb,6)+1; |
177 | /*ci->time_type=_ogg_malloc(ci->times*sizeof(*ci->time_type));*/ | 177 | if(ci->times<=0)goto err_out; |
178 | /*ci->time_param=_ogg_calloc(ci->times,sizeof(void *));*/ | ||
179 | for(i=0;i<ci->times;i++){ | 178 | for(i=0;i<ci->times;i++){ |
180 | ci->time_type[i]=oggpack_read(opb,16); | 179 | ci->time_type[i]=oggpack_read(opb,16); |
181 | if(ci->time_type[i]<0 || ci->time_type[i]>=VI_TIMEB)goto err_out; | 180 | if(ci->time_type[i]<0 || ci->time_type[i]>=VI_TIMEB)goto err_out; |
@@ -186,8 +185,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
186 | 185 | ||
187 | /* floor backend settings */ | 186 | /* floor backend settings */ |
188 | ci->floors=oggpack_read(opb,6)+1; | 187 | ci->floors=oggpack_read(opb,6)+1; |
189 | /*ci->floor_type=_ogg_malloc(ci->floors*sizeof(*ci->floor_type));*/ | 188 | if(ci->floors<=0)goto err_out; |
190 | /*ci->floor_param=_ogg_calloc(ci->floors,sizeof(void *));*/ | ||
191 | for(i=0;i<ci->floors;i++){ | 189 | for(i=0;i<ci->floors;i++){ |
192 | ci->floor_type[i]=oggpack_read(opb,16); | 190 | ci->floor_type[i]=oggpack_read(opb,16); |
193 | if(ci->floor_type[i]<0 || ci->floor_type[i]>=VI_FLOORB)goto err_out; | 191 | if(ci->floor_type[i]<0 || ci->floor_type[i]>=VI_FLOORB)goto err_out; |
@@ -197,8 +195,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
197 | 195 | ||
198 | /* residue backend settings */ | 196 | /* residue backend settings */ |
199 | ci->residues=oggpack_read(opb,6)+1; | 197 | ci->residues=oggpack_read(opb,6)+1; |
200 | /*ci->residue_type=_ogg_malloc(ci->residues*sizeof(*ci->residue_type));*/ | 198 | if(ci->residues<=0)goto err_out; |
201 | /*ci->residue_param=_ogg_calloc(ci->residues,sizeof(void *));*/ | ||
202 | for(i=0;i<ci->residues;i++){ | 199 | for(i=0;i<ci->residues;i++){ |
203 | ci->residue_type[i]=oggpack_read(opb,16); | 200 | ci->residue_type[i]=oggpack_read(opb,16); |
204 | if(ci->residue_type[i]<0 || ci->residue_type[i]>=VI_RESB)goto err_out; | 201 | if(ci->residue_type[i]<0 || ci->residue_type[i]>=VI_RESB)goto err_out; |
@@ -208,8 +205,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
208 | 205 | ||
209 | /* map backend settings */ | 206 | /* map backend settings */ |
210 | ci->maps=oggpack_read(opb,6)+1; | 207 | ci->maps=oggpack_read(opb,6)+1; |
211 | /*ci->map_type=_ogg_malloc(ci->maps*sizeof(*ci->map_type));*/ | 208 | if(ci->maps<=0)goto err_out; |
212 | /*ci->map_param=_ogg_calloc(ci->maps,sizeof(void *));*/ | ||
213 | for(i=0;i<ci->maps;i++){ | 209 | for(i=0;i<ci->maps;i++){ |
214 | ci->map_type[i]=oggpack_read(opb,16); | 210 | ci->map_type[i]=oggpack_read(opb,16); |
215 | if(ci->map_type[i]<0 || ci->map_type[i]>=VI_MAPB)goto err_out; | 211 | if(ci->map_type[i]<0 || ci->map_type[i]>=VI_MAPB)goto err_out; |
@@ -219,7 +215,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
219 | 215 | ||
220 | /* mode settings */ | 216 | /* mode settings */ |
221 | ci->modes=oggpack_read(opb,6)+1; | 217 | ci->modes=oggpack_read(opb,6)+1; |
222 | /*vi->mode_param=_ogg_calloc(vi->modes,sizeof(void *));*/ | 218 | if(ci->modes<=0)goto err_out; |
223 | for(i=0;i<ci->modes;i++){ | 219 | for(i=0;i<ci->modes;i++){ |
224 | ci->mode_param[i]=(vorbis_info_mode *)_ogg_calloc(1,sizeof(*ci->mode_param[i])); | 220 | ci->mode_param[i]=(vorbis_info_mode *)_ogg_calloc(1,sizeof(*ci->mode_param[i])); |
225 | ci->mode_param[i]->blockflag=oggpack_read(opb,1); | 221 | ci->mode_param[i]->blockflag=oggpack_read(opb,1); |
@@ -230,6 +226,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ | |||
230 | if(ci->mode_param[i]->windowtype>=VI_WINDOWB)goto err_out; | 226 | if(ci->mode_param[i]->windowtype>=VI_WINDOWB)goto err_out; |
231 | if(ci->mode_param[i]->transformtype>=VI_WINDOWB)goto err_out; | 227 | if(ci->mode_param[i]->transformtype>=VI_WINDOWB)goto err_out; |
232 | if(ci->mode_param[i]->mapping>=ci->maps)goto err_out; | 228 | if(ci->mode_param[i]->mapping>=ci->maps)goto err_out; |
229 | if(ci->mode_param[i]->mapping<0)goto err_out; | ||
233 | } | 230 | } |
234 | 231 | ||
235 | if(oggpack_read(opb,1)!=1)goto err_out; /* top level EOP check */ | 232 | if(oggpack_read(opb,1)!=1)goto err_out; /* top level EOP check */ |