Commit 168aff53 authored by Cyril Deguet's avatar Cyril Deguet

- check size to avoid realloc(0)

parent dcd1ba26
...@@ -2,7 +2,7 @@ ...@@ -2,7 +2,7 @@
* input_dec.c: Functions for the management of decoders * input_dec.c: Functions for the management of decoders
***************************************************************************** *****************************************************************************
* Copyright (C) 1999-2001 VideoLAN * Copyright (C) 1999-2001 VideoLAN
* $Id: input_dec.c,v 1.34 2002/05/14 21:23:44 massiot Exp $ * $Id: input_dec.c,v 1.35 2002/05/15 15:46:34 asmax Exp $
* *
* Authors: Christophe Massiot <massiot@via.ecp.fr> * Authors: Christophe Massiot <massiot@via.ecp.fr>
* *
...@@ -224,6 +224,8 @@ static decoder_config_t * CreateDecoderConfig( input_thread_t * p_input, ...@@ -224,6 +224,8 @@ static decoder_config_t * CreateDecoderConfig( input_thread_t * p_input,
/* Select a new ES */ /* Select a new ES */
p_input->stream.i_selected_es_number++; p_input->stream.i_selected_es_number++;
if( p_input->stream.i_selected_es_number > 0 )
{
p_input->stream.pp_selected_es = realloc( p_input->stream.pp_selected_es = realloc(
p_input->stream.pp_selected_es, p_input->stream.pp_selected_es,
p_input->stream.i_selected_es_number p_input->stream.i_selected_es_number
...@@ -235,6 +237,16 @@ static decoder_config_t * CreateDecoderConfig( input_thread_t * p_input, ...@@ -235,6 +237,16 @@ static decoder_config_t * CreateDecoderConfig( input_thread_t * p_input,
free( p_config ); free( p_config );
return NULL; return NULL;
} }
}
else
{
intf_ErrMsg( "realloc(0) (p_input->stream.i_selected_es_number "
"corrupted?)" );
free( p_config->p_decoder_fifo );
free( p_config );
return NULL;
}
p_input->stream.pp_selected_es[p_input->stream.i_selected_es_number - 1] p_input->stream.pp_selected_es[p_input->stream.i_selected_es_number - 1]
= p_es; = p_es;
......
...@@ -2,7 +2,7 @@ ...@@ -2,7 +2,7 @@
* input_programs.c: es_descriptor_t, pgrm_descriptor_t management * input_programs.c: es_descriptor_t, pgrm_descriptor_t management
***************************************************************************** *****************************************************************************
* Copyright (C) 1999-2001 VideoLAN * Copyright (C) 1999-2001 VideoLAN
* $Id: input_programs.c,v 1.85 2002/05/13 21:55:30 fenrir Exp $ * $Id: input_programs.c,v 1.86 2002/05/15 15:46:34 asmax Exp $
* *
* Authors: Christophe Massiot <massiot@via.ecp.fr> * Authors: Christophe Massiot <massiot@via.ecp.fr>
* *
...@@ -142,6 +142,8 @@ pgrm_descriptor_t * input_AddProgram( input_thread_t * p_input, ...@@ -142,6 +142,8 @@ pgrm_descriptor_t * input_AddProgram( input_thread_t * p_input,
/* Add an entry to the list of program associated with the stream */ /* Add an entry to the list of program associated with the stream */
p_input->stream.i_pgrm_number++; p_input->stream.i_pgrm_number++;
if( p_input->stream.i_pgrm_number > 0 )
{
p_input->stream.pp_programs = realloc( p_input->stream.pp_programs, p_input->stream.pp_programs = realloc( p_input->stream.pp_programs,
p_input->stream.i_pgrm_number p_input->stream.i_pgrm_number
* sizeof(pgrm_descriptor_t *) ); * sizeof(pgrm_descriptor_t *) );
...@@ -150,6 +152,11 @@ pgrm_descriptor_t * input_AddProgram( input_thread_t * p_input, ...@@ -150,6 +152,11 @@ pgrm_descriptor_t * input_AddProgram( input_thread_t * p_input,
intf_ErrMsg( "Unable to realloc memory in input_AddProgram" ); intf_ErrMsg( "Unable to realloc memory in input_AddProgram" );
return( NULL ); return( NULL );
} }
}
else {
intf_ErrMsg( "realloc(0) (p_input->stream.i_pgrm_number corrupted ?)");
return( NULL );
}
/* Allocate the structure to store this description */ /* Allocate the structure to store this description */
p_input->stream.pp_programs[i_pgrm_index] = p_input->stream.pp_programs[i_pgrm_index] =
...@@ -229,16 +236,23 @@ void input_DelProgram( input_thread_t * p_input, pgrm_descriptor_t * p_pgrm ) ...@@ -229,16 +236,23 @@ void input_DelProgram( input_thread_t * p_input, pgrm_descriptor_t * p_pgrm )
p_input->stream.pp_programs[i_pgrm_index] = p_input->stream.pp_programs[i_pgrm_index] =
p_input->stream.pp_programs[p_input->stream.i_pgrm_number]; p_input->stream.pp_programs[p_input->stream.i_pgrm_number];
if( p_input->stream.i_pgrm_number > 0 )
{
p_input->stream.pp_programs = realloc( p_input->stream.pp_programs, p_input->stream.pp_programs = realloc( p_input->stream.pp_programs,
p_input->stream.i_pgrm_number p_input->stream.i_pgrm_number
* sizeof(pgrm_descriptor_t *) ); * sizeof(pgrm_descriptor_t *) );
if( p_input->stream.pp_programs == NULL )
if( p_input->stream.i_pgrm_number && p_input->stream.pp_programs == NULL)
{ {
intf_ErrMsg( "input error: unable to realloc program list" intf_ErrMsg( "input error: unable to realloc program list"
" in input_DelProgram" ); " in input_DelProgram" );
} }
}
else
{
free( p_input->stream.pp_programs );
}
/* Free the description of this program */ /* Free the description of this program */
free( p_pgrm ); free( p_pgrm );
} }
...@@ -255,6 +269,8 @@ input_area_t * input_AddArea( input_thread_t * p_input ) ...@@ -255,6 +269,8 @@ input_area_t * input_AddArea( input_thread_t * p_input )
/* Add an entry to the list of program associated with the stream */ /* Add an entry to the list of program associated with the stream */
p_input->stream.i_area_nb++; p_input->stream.i_area_nb++;
if( p_input->stream.i_area_nb > 0 )
{
p_input->stream.pp_areas = realloc( p_input->stream.pp_areas, p_input->stream.pp_areas = realloc( p_input->stream.pp_areas,
p_input->stream.i_area_nb p_input->stream.i_area_nb
* sizeof(input_area_t *) ); * sizeof(input_area_t *) );
...@@ -263,6 +279,12 @@ input_area_t * input_AddArea( input_thread_t * p_input ) ...@@ -263,6 +279,12 @@ input_area_t * input_AddArea( input_thread_t * p_input )
intf_ErrMsg( "Unable to realloc memory in input_AddArea" ); intf_ErrMsg( "Unable to realloc memory in input_AddArea" );
return( NULL ); return( NULL );
} }
}
else
{
intf_ErrMsg( "realloc(0) (p_input->stream.i_area_nb corrupted ?)");
return( NULL );
}
/* Allocate the structure to store this description */ /* Allocate the structure to store this description */
p_input->stream.pp_areas[i_area_index] = p_input->stream.pp_areas[i_area_index] =
...@@ -408,15 +430,22 @@ void input_DelArea( input_thread_t * p_input, input_area_t * p_area ) ...@@ -408,15 +430,22 @@ void input_DelArea( input_thread_t * p_input, input_area_t * p_area )
p_input->stream.pp_areas[i_area_index] = p_input->stream.pp_areas[i_area_index] =
p_input->stream.pp_areas[p_input->stream.i_area_nb]; p_input->stream.pp_areas[p_input->stream.i_area_nb];
if( p_input->stream.i_area_nb > 0 )
{
p_input->stream.pp_areas = realloc( p_input->stream.pp_areas, p_input->stream.pp_areas = realloc( p_input->stream.pp_areas,
p_input->stream.i_area_nb p_input->stream.i_area_nb
* sizeof(input_area_t *) ); * sizeof(input_area_t *) );
if( p_input->stream.i_area_nb && p_input->stream.pp_areas == NULL) if( p_input->stream.pp_areas == NULL )
{ {
intf_ErrMsg( "input error: unable to realloc area list" intf_ErrMsg( "input error: unable to realloc area list"
" in input_DelArea" ); " in input_DelArea" );
} }
}
else
{
free( p_input->stream.pp_areas );
}
/* Free the description of this area */ /* Free the description of this area */
free( p_area ); free( p_area );
...@@ -461,6 +490,8 @@ es_descriptor_t * input_AddES( input_thread_t * p_input, ...@@ -461,6 +490,8 @@ es_descriptor_t * input_AddES( input_thread_t * p_input,
return( NULL); return( NULL);
} }
p_input->stream.i_es_number++; p_input->stream.i_es_number++;
if( p_input->stream.i_es_number > 0 )
{
p_input->stream.pp_es = realloc( p_input->stream.pp_es, p_input->stream.pp_es = realloc( p_input->stream.pp_es,
p_input->stream.i_es_number p_input->stream.i_es_number
* sizeof(es_descriptor_t *) ); * sizeof(es_descriptor_t *) );
...@@ -469,6 +500,12 @@ es_descriptor_t * input_AddES( input_thread_t * p_input, ...@@ -469,6 +500,12 @@ es_descriptor_t * input_AddES( input_thread_t * p_input,
intf_ErrMsg( "Unable to realloc memory in input_AddES" ); intf_ErrMsg( "Unable to realloc memory in input_AddES" );
return( NULL ); return( NULL );
} }
}
else
{
intf_ErrMsg( "realloc(0) (p_input->stream.pp_es_number corrupted ?)");
return( NULL );
}
p_input->stream.pp_es[p_input->stream.i_es_number - 1] = p_es; p_input->stream.pp_es[p_input->stream.i_es_number - 1] = p_es;
/* Init its values */ /* Init its values */
...@@ -499,6 +536,8 @@ es_descriptor_t * input_AddES( input_thread_t * p_input, ...@@ -499,6 +536,8 @@ es_descriptor_t * input_AddES( input_thread_t * p_input,
if( p_pgrm ) if( p_pgrm )
{ {
p_pgrm->i_es_number++; p_pgrm->i_es_number++;
if( p_pgrm->i_es_number > 0 )
{
p_pgrm->pp_es = realloc( p_pgrm->pp_es, p_pgrm->pp_es = realloc( p_pgrm->pp_es,
p_pgrm->i_es_number p_pgrm->i_es_number
* sizeof(es_descriptor_t *) ); * sizeof(es_descriptor_t *) );
...@@ -507,6 +546,12 @@ es_descriptor_t * input_AddES( input_thread_t * p_input, ...@@ -507,6 +546,12 @@ es_descriptor_t * input_AddES( input_thread_t * p_input,
intf_ErrMsg( "Unable to realloc memory in input_AddES" ); intf_ErrMsg( "Unable to realloc memory in input_AddES" );
return( NULL ); return( NULL );
} }
}
else
{
intf_ErrMsg( "realloc(0) (p_pgrm->i_es_number corrupted ?)");
return( NULL );
}
p_pgrm->pp_es[p_pgrm->i_es_number - 1] = p_es; p_pgrm->pp_es[p_pgrm->i_es_number - 1] = p_es;
p_es->p_pgrm = p_pgrm; p_es->p_pgrm = p_pgrm;
} }
...@@ -545,12 +590,20 @@ void input_DelES( input_thread_t * p_input, es_descriptor_t * p_es ) ...@@ -545,12 +590,20 @@ void input_DelES( input_thread_t * p_input, es_descriptor_t * p_es )
{ {
p_pgrm->i_es_number--; p_pgrm->i_es_number--;
p_pgrm->pp_es[i_index] = p_pgrm->pp_es[p_pgrm->i_es_number]; p_pgrm->pp_es[i_index] = p_pgrm->pp_es[p_pgrm->i_es_number];
if( p_pgrm->i_es_number > 0 )
{
p_pgrm->pp_es = realloc( p_pgrm->pp_es, p_pgrm->pp_es = realloc( p_pgrm->pp_es,
p_pgrm->i_es_number p_pgrm->i_es_number
* sizeof(es_descriptor_t *)); * sizeof(es_descriptor_t *));
if( p_pgrm->i_es_number && p_pgrm->pp_es == NULL ) if( p_pgrm->pp_es == NULL )
{ {
intf_ErrMsg( "Unable to realloc memory in input_DelES" ); intf_ErrMsg( "Unable to realloc memory in "
"input_DelES" );
}
}
else
{
free( p_pgrm->pp_es );
} }
break; break;
} }
...@@ -576,13 +629,20 @@ void input_DelES( input_thread_t * p_input, es_descriptor_t * p_es ) ...@@ -576,13 +629,20 @@ void input_DelES( input_thread_t * p_input, es_descriptor_t * p_es )
p_input->stream.i_es_number--; p_input->stream.i_es_number--;
p_input->stream.pp_es[i_es_index] = p_input->stream.pp_es[i_es_index] =
p_input->stream.pp_es[p_input->stream.i_es_number]; p_input->stream.pp_es[p_input->stream.i_es_number];
if( p_input->stream.i_es_number > 0 )
{
p_input->stream.pp_es = realloc( p_input->stream.pp_es, p_input->stream.pp_es = realloc( p_input->stream.pp_es,
p_input->stream.i_es_number p_input->stream.i_es_number
* sizeof(es_descriptor_t *)); * sizeof(es_descriptor_t *));
if( p_input->stream.i_es_number && p_input->stream.pp_es == NULL ) if( p_input->stream.pp_es == NULL )
{ {
intf_ErrMsg( "Unable to realloc memory in input_DelES" ); intf_ErrMsg( "Unable to realloc memory in input_DelES" );
} }
}
else
{
free( p_input->stream.pp_es );
}
} }
...@@ -696,15 +756,22 @@ int input_UnselectES( input_thread_t * p_input, es_descriptor_t * p_es ) ...@@ -696,15 +756,22 @@ int input_UnselectES( input_thread_t * p_input, es_descriptor_t * p_es )
p_input->stream.pp_selected_es[i_index] = p_input->stream.pp_selected_es[i_index] =
p_input->stream.pp_selected_es[p_input->stream.i_selected_es_number]; p_input->stream.pp_selected_es[p_input->stream.i_selected_es_number];
if( p_input->stream.i_selected_es_number > 0 )
{
p_input->stream.pp_selected_es = realloc( p_input->stream.pp_selected_es = realloc(
p_input->stream.pp_selected_es, p_input->stream.pp_selected_es,
p_input->stream.i_selected_es_number p_input->stream.i_selected_es_number
* sizeof(es_descriptor_t *) ); * sizeof(es_descriptor_t *) );
if( p_input->stream.pp_selected_es == NULL ) if( p_input->stream.pp_selected_es == NULL )
{ {
intf_WarnMsg( 4, "input: no more selected ES in input_UnselectES" ); intf_ErrMsg( "Unable to realloc memory in input_UnselectES" );
return( 1 ); return( -1 );
}
}
else
{
free( p_input->stream.pp_selected_es );
intf_WarnMsg( 4, "input: no more selected ES in input_UnselectES" ); return( 1 );
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment