5 files changed, 29 insertions, 26 deletions

diff --git a/apps/codecs/libtremor/codebook.c b/apps/codecs/libtremor/codebook.c
index 2b92e216cc..fd473280b2 100644
--- a/apps/codecs/libtremor/codebook.c
+++ b/apps/codecs/libtremor/codebook.c
@@ -26,9 +26,9 @@
 
 /* unpacks a codebook from the packet buffer into the codebook struct,
    readies the codebook auxiliary structures for decode *************/
-int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
+static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
   long i,j;
-  memset(s,0,sizeof(*s));
+  static_codebook *s=_ogg_calloc(1,sizeof(*s));
 
   /* make sure alignment is correct */
   if(oggpack_read(opb,24)!=0x564342)goto _eofout;
@@ -75,17 +75,18 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
       s->lengthlist=(long *)_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
 
       for(i=0;i<s->entries;){
-        long num=oggpack_read(opb,_ilog(s->entries-i));
-        if(num==-1)goto _eofout;
-        for(j=0;j<num && i<s->entries;j++,i++)
-          s->lengthlist[i]=length;
-        length++;
+        long num=oggpack_read(opb,_ilog(s->entries-i));
+        if(num==-1)goto _eofout;
+        if(length>32)goto _errout;
+        for(j=0;j<num && i<s->entries;j++,i++)
+          s->lengthlist[i]=length;
+        length++;
       }
     }
     break;
   default:
     /* EOF */
-    return(-1);
+    goto _eofout;
   }
   
   /* Do we have a mapping to unpack? */
@@ -127,12 +128,12 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
   }
 
   /* all set */
-  return(0);
+  return(s);
   
  _errout:
  _eofout:
-  vorbis_staticbook_clear(s);
-  return(-1); 
+  vorbis_staticbook_destroy(s);
+  return(NULL); 
 }
 
 /* the 'eliminate the decode tree' optimization actually requires the
diff --git a/apps/codecs/libtremor/codebook.h b/apps/codecs/libtremor/codebook.h
index b13334d8d7..29ac9fd923 100644
--- a/apps/codecs/libtremor/codebook.h
+++ b/apps/codecs/libtremor/codebook.h
@@ -76,14 +76,13 @@ typedef struct codebook{
 
 } codebook;
 
-extern void vorbis_staticbook_clear(static_codebook *b);
 extern void vorbis_staticbook_destroy(static_codebook *b);
 extern int vorbis_book_init_decode(codebook *dest,const static_codebook *source);
 
 extern void vorbis_book_clear(codebook *b);
 extern long _book_maptype1_quantvals(const static_codebook *b);
 
-extern int vorbis_staticbook_unpack(oggpack_buffer *b,static_codebook *c);
+extern static_codebook *vorbis_staticbook_unpack(oggpack_buffer *b);
 
 extern long vorbis_book_decode(codebook *book, oggpack_buffer *b);
 extern long vorbis_book_decodevs_add(codebook *book, ogg_int32_t *a, 
diff --git a/apps/codecs/libtremor/info.c b/apps/codecs/libtremor/info.c
index b819570682..b21d08de49 100644
--- a/apps/codecs/libtremor/info.c
+++ b/apps/codecs/libtremor/info.c
@@ -168,8 +168,8 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){
   ci->books=oggpack_read(opb,8)+1;
   if(ci->books<=0)goto err_out;
   for(i=0;i<ci->books;i++){
-    ci->book_param[i]=(static_codebook *)_ogg_calloc(1,sizeof(*ci->book_param[i]));
-    if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out;
+    ci->book_param[i]=vorbis_staticbook_unpack(opb);
+    if(!ci->book_param[i])goto err_out;
   }
 
   /* time backend settings */
diff --git a/apps/codecs/libtremor/sharedbook.c b/apps/codecs/libtremor/sharedbook.c
index 884920ecda..e9cdd13329 100644
--- a/apps/codecs/libtremor/sharedbook.c
+++ b/apps/codecs/libtremor/sharedbook.c
@@ -295,15 +295,10 @@ static ogg_int32_t *_book_unquantize(const static_codebook *b,int n,
   return(NULL);
 }
 
-void vorbis_staticbook_clear(static_codebook *b){
+void vorbis_staticbook_destroy(static_codebook *b){
   if(b->quantlist)_ogg_free(b->quantlist);
   if(b->lengthlist)_ogg_free(b->lengthlist);
   memset(b,0,sizeof(*b));
-
-}
-
-void vorbis_staticbook_destroy(static_codebook *b){
-  vorbis_staticbook_clear(b);
   _ogg_free(b);
 }
 
diff --git a/apps/codecs/libtremor/synthesis.c b/apps/codecs/libtremor/synthesis.c
index c47f381592..657aa74e11 100644
--- a/apps/codecs/libtremor/synthesis.c
+++ b/apps/codecs/libtremor/synthesis.c
@@ -28,13 +28,17 @@
 static ogg_int32_t *ipcm_vect[CHANNELS] IBSS_ATTR;
 
 static inline int _vorbis_synthesis1(vorbis_block *vb,ogg_packet *op,int decodep){
-  vorbis_dsp_state     *vd=vb->vd;
-  private_state        *b=(private_state *)vd->backend_state;
-  vorbis_info          *vi=vd->vi;
-  codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
-  oggpack_buffer       *opb=&vb->opb;
+  vorbis_dsp_state     *vd= vb ? vb->vd : 0;
+  private_state        *b= vd ? (private_state *)vd->backend_state: 0;
+  vorbis_info          *vi= vd ? vd->vi : 0;
+  codec_setup_info     *ci= vi ? (codec_setup_info *)vi->codec_setup : 0;
+  oggpack_buffer       *opb=vb ? &vb->opb : 0;
   int                   type,mode,i;
  
+  if (!vd || !b || !vi || !ci || !opb) {
+    return OV_EBADPACKET;
+  }
+
   /* first things first.  Make sure decode is ready */
   _vorbis_block_ripcord(vb);
   oggpack_readinit(opb,op->packet,op->bytes);
@@ -50,6 +54,10 @@ static inline int _vorbis_synthesis1(vorbis_block *vb,ogg_packet *op,int decodep
   if(mode==-1)return(OV_EBADPACKET);
   
   vb->mode=mode;
+  if(!ci->mode_param[mode]){
+    return(OV_EBADPACKET);
+  }
+
   vb->W=ci->mode_param[mode]->blockflag;
   if(vb->W){
     vb->lW=oggpack_read(opb,1);