[xiph-commits] r3851 - in libfishsound/trunk: include/fishsound src/libfishsound
conrad at svn.annodex.net
conrad at svn.annodex.net
Fri Feb 20 04:42:38 PST 2009
Author: conrad
Date: 2009-02-20 04:42:37 -0800 (Fri, 20 Feb 2009)
New Revision: 3851
Modified:
libfishsound/trunk/include/fishsound/constants.h
libfishsound/trunk/include/fishsound/decode.h
libfishsound/trunk/src/libfishsound/comments.c
libfishsound/trunk/src/libfishsound/flac.c
libfishsound/trunk/src/libfishsound/speex.c
libfishsound/trunk/src/libfishsound/vorbis.c
Log:
Chase mallocs in comments.c, esp. _fs_comment_add and fs_strdup()
Towards Mozilla bug 468293
Adds FISH_SOUND_ERR_OUT_OF_MEMORY error return value, which can be
returned by fishsound_decode()
Modified: libfishsound/trunk/include/fishsound/constants.h
===================================================================
--- libfishsound/trunk/include/fishsound/constants.h 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/include/fishsound/constants.h 2009-02-20 12:42:37 UTC (rev 3851)
@@ -106,6 +106,9 @@
/** The requested operation is not suitable for this FishSound* handle */
FISH_SOUND_ERR_INVALID = -3,
+ /** Out of memory */
+ FISH_SOUND_ERR_OUT_OF_MEMORY = -4,
+
/** Functionality disabled at build time */
FISH_SOUND_ERR_DISABLED = -10,
Modified: libfishsound/trunk/include/fishsound/decode.h
===================================================================
--- libfishsound/trunk/include/fishsound/decode.h 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/include/fishsound/decode.h 2009-02-20 12:42:37 UTC (rev 3851)
@@ -113,6 +113,7 @@
* callback returning FISH_SOUND_STOP_ERR before any input bytes were consumed.
* This will occur when PCM is decoded from previously buffered input, and
* stopping is immediately requested.
+ * \retval FISH_SOUND_ERR_OUT_OF_MEMORY Out of memory
*/
long fish_sound_decode (FishSound * fsound, unsigned char * buf, long bytes);
Modified: libfishsound/trunk/src/libfishsound/comments.c
===================================================================
--- libfishsound/trunk/src/libfishsound/comments.c 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/src/libfishsound/comments.c 2009-02-20 12:42:37 UTC (rev 3851)
@@ -138,12 +138,23 @@
FishSoundComment * comment;
if (!fs_comment_validate_byname (name, value)) return NULL;
+ /* Ensures that name != NULL, value != NULL, and validates strings */
comment = fs_malloc (sizeof (FishSoundComment));
if (comment == NULL) return NULL;
comment->name = fs_strdup (name);
+ if (comment->name == NULL) {
+ fs_free (comment);
+ return NULL;
+ }
+
comment->value = fs_strdup (value);
+ if (comment->value == NULL) {
+ fs_free (comment->name);
+ fs_free (comment);
+ return NULL;
+ }
return comment;
}
@@ -169,16 +180,6 @@
return 1;
}
-/* Public API */
-
-const char *
-fish_sound_comment_get_vendor (FishSound * fsound)
-{
- if (fsound == NULL) return NULL;
-
- return fsound->vendor;
-}
-
int
fish_sound_comment_set_vendor (FishSound * fsound, const char * vendor_string)
{
@@ -186,11 +187,22 @@
if (fsound->vendor) fs_free (fsound->vendor);
- fsound->vendor = fs_strdup (vendor_string);
+ if ((fsound->vendor = fs_strdup (vendor_string)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
return 0;
}
+/* Public API */
+
+const char *
+fish_sound_comment_get_vendor (FishSound * fsound)
+{
+ if (fsound == NULL) return NULL;
+
+ return fsound->vendor;
+}
+
const FishSoundComment *
fish_sound_comment_first (FishSound * fsound)
{
@@ -269,11 +281,13 @@
if (!fs_comment_validate_byname (comment->name, comment->value))
return FISH_SOUND_ERR_COMMENT_INVALID;
- new_comment = fs_comment_new (comment->name, comment->value);
+ if ((new_comment = fs_comment_new (comment->name, comment->value)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
- _fs_comment_add (fsound, new_comment);
+ if (_fs_comment_add (fsound, new_comment) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
- return 0;
+ return FISH_SOUND_OK;
#else
return FISH_SOUND_ERR_DISABLED;
#endif
@@ -294,10 +308,14 @@
if (!fs_comment_validate_byname (name, value))
return FISH_SOUND_ERR_COMMENT_INVALID;
- comment = fs_comment_new (name, value);
+ if ((comment = fs_comment_new (name, value)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
- _fs_comment_add (fsound, comment);
+ if (_fs_comment_add (fsound, comment) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ return FISH_SOUND_OK;
+
return 0;
#else
@@ -402,9 +420,14 @@
if (c+len>end) return -1;
/* Vendor */
- nvalue = fs_strdup_len (c, len);
- fish_sound_comment_set_vendor (fsound, nvalue);
- if (nvalue) fs_free (nvalue);
+ if (len > 0) {
+ if ((nvalue = fs_strdup_len (c, len)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ if (fish_sound_comment_set_vendor (fsound, nvalue) == FISH_SOUND_ERR_OUT_OF_MEMORY)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
+ fs_free (nvalue);
+ }
#ifdef DEBUG
fwrite(c, 1, len, stderr); fputc ('\n', stderr);
#endif
@@ -437,22 +460,33 @@
value++;
n = c+len - value;
- nvalue = fs_strdup_len (value, n);
+ if ((nvalue = fs_strdup_len (value, n)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
#ifdef DEBUG
printf ("fish_sound_comments_decode: %s -> %s (length %d)\n",
name, nvalue, n);
#endif
- comment = fs_comment_new (name, nvalue);
- _fs_comment_add (fsound, comment);
+ if ((comment = fs_comment_new (name, nvalue)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
+ if (_fs_comment_add (fsound, comment) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
fs_free (nvalue);
} else {
#ifdef DEBUG
printf ("fish_sound_comments_decode: [%d] %s (no value)\n",
i, name, len);
#endif
- nvalue = fs_strdup_len (name, len);
- comment = fs_comment_new (nvalue, NULL);
- _fs_comment_add (fsound, comment);
+ if ((nvalue = fs_strdup_len (name, len)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
+ if ((comment = fs_comment_new (nvalue, NULL)) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
+ if (_fs_comment_add (fsound, comment) == NULL)
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+
fs_free (nvalue);
}
@@ -463,7 +497,7 @@
printf ("fish_sound_comments_decode: done\n");
#endif
- return 0;
+ return FISH_SOUND_OK;
}
long
Modified: libfishsound/trunk/src/libfishsound/flac.c
===================================================================
--- libfishsound/trunk/src/libfishsound/flac.c 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/src/libfishsound/flac.c 2009-02-20 12:42:37 UTC (rev 3851)
@@ -316,7 +316,10 @@
#ifdef DEBUG
printf ("fs_flac_decode: got vorbiscomments len %d\n", len);
#endif
- fish_sound_comments_decode (fsound, buf+4, len);
+ if (fish_sound_comments_decode (fsound, buf+4, len) == FISH_SOUND_ERR_OUT_OF_MEMORY) {
+ fi->packetno++;
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ }
}
memcpy(tmp, fi->buffer, fi->bufferlength);
Modified: libfishsound/trunk/src/libfishsound/speex.c
===================================================================
--- libfishsound/trunk/src/libfishsound/speex.c 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/src/libfishsound/speex.c 2009-02-20 12:42:37 UTC (rev 3851)
@@ -320,7 +320,10 @@
} else if (fss->packetno == 1) {
/* Comments */
- fish_sound_comments_decode (fsound, buf, bytes);
+ if (fish_sound_comments_decode (fsound, buf, bytes) == FISH_SOUND_ERR_OUT_OF_MEMORY) {
+ fss->packetno++;
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ }
} else if (fss->packetno <= 1+fss->extra_headers) {
/* Unknown extra headers */
} else {
@@ -402,7 +405,10 @@
/* Allocate and create comments */
snprintf (vendor_string, 128, VENDOR_FORMAT, header.speex_version);
- fish_sound_comment_set_vendor (fsound, vendor_string);
+ if (fish_sound_comment_set_vendor (fsound, vendor_string) == FISH_SOUND_ERR_OUT_OF_MEMORY) {
+ fs_free (header_buf);
+ return NULL;
+ }
comments_bytes = fish_sound_comments_encode (fsound, NULL, 0);
comments_buf = fs_malloc (comments_bytes);
if (comments_buf == NULL) {
Modified: libfishsound/trunk/src/libfishsound/vorbis.c
===================================================================
--- libfishsound/trunk/src/libfishsound/vorbis.c 2009-02-20 09:19:45 UTC (rev 3850)
+++ libfishsound/trunk/src/libfishsound/vorbis.c 2009-02-20 12:42:37 UTC (rev 3851)
@@ -141,7 +141,10 @@
* start of vorbiscomment packet. */
if (fsv->packetno == 1 && bytes > 7 && buf[0] == 0x03 &&
!strncmp ((char *)&buf[1], "vorbis", 6)) {
- fish_sound_comments_decode (fsound, buf+7, bytes-7);
+ if (fish_sound_comments_decode (fsound, buf+7, bytes-7) == FISH_SOUND_ERR_OUT_OF_MEMORY) {
+ fsv->packetno++;
+ return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ }
} else if (fsv->packetno == 2) {
vorbis_synthesis_init (&fsv->vd, &fsv->vi);
vorbis_block_init (&fsv->vd, &fsv->vb);
More information about the commits
mailing list