[PATCH] libosmocore[master]: core/conv/viterbi.c: fix possible NULL-pointer reference

[Vadim Yanitskiy]

Review at  https://gerrit.osmocom.org/2876

core/conv/viterbi.c: fix possible NULL-pointer reference

Change-Id: I36012d4443d97470050cdf9638a9d4cf67ea3b40
---
M src/viterbi.c
1 file changed, 29 insertions(+), 7 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/76/2876/1

diff --git a/src/viterbi.c b/src/viterbi.c
index 854754c..f66986e 100644
--- a/src/viterbi.c
+++ b/src/viterbi.c
@@ -371,9 +371,15 @@
        if (!trellis)
                return;
 
-       vdec_free(trellis->outputs);
-       vdec_free(trellis->sums);
-       free(trellis->vals);
+       if (trellis->outputs != NULL)
+               vdec_free(trellis->outputs);
+
+       if (trellis->sums != NULL)
+               vdec_free(trellis->sums);
+
+       if (trellis->vals != NULL)
+               free(trellis->vals);
+
        free(trellis);
 }
 
@@ -394,12 +400,15 @@
        int olen = (code->N == 2) ? 2 : 4;
 
        trellis = (struct vtrellis *) calloc(1, sizeof(struct vtrellis));
+       if (!trellis)
+               goto fail;
+
        trellis->num_states = ns;
        trellis->sums = vdec_malloc(ns);
        trellis->outputs = vdec_malloc(ns * olen);
        trellis->vals = (uint8_t *) malloc(ns * sizeof(uint8_t));
 
-       if (!trellis->sums || !trellis->outputs)
+       if (!trellis->sums || !trellis->outputs || !trellis->vals)
                goto fail;
 
        /* Populate the trellis state objects */
@@ -507,9 +516,16 @@
        if (!dec)
                return;
 
-       vdec_free(dec->paths[0]);
-       free(dec->paths);
-       free_trellis(dec->trellis);
+       if (dec->trellis != NULL)
+               free_trellis(dec->trellis);
+
+       if (dec->paths != NULL) {
+               if (dec->paths[0] != NULL)
+                       vdec_free(dec->paths[0]);
+
+               free(dec->paths);
+       }
+
        free(dec);
 }
 
@@ -572,7 +588,13 @@
                goto fail;
 
        dec->paths = (int16_t **) malloc(sizeof(int16_t *) * dec->len);
+       if (!dec->paths)
+               goto fail;
+
        dec->paths[0] = vdec_malloc(ns * dec->len);
+       if (!dec->paths[0])
+               goto fail;
+
        for (i = 1; i < dec->len; i++)
                dec->paths[i] = &dec->paths[0][i * ns];
 

-- 
To view, visit https://gerrit.osmocom.org/2876
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I36012d4443d97470050cdf9638a9d4cf67ea3b40
Gerrit-PatchSet: 1
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Owner: Vadim Yanitskiy <axilira...@gmail.com>