libbluray | branch: master | hpi1 <[email protected]> | Tue Jan 21 10:24:02 2014 +0200| [3c37221f4e16301a762688b463668677d6121ae0] | committer: hpi1
hdmv: check for memory allocation failures > http://git.videolan.org/gitweb.cgi/libbluray.git/?a=commit;h=3c37221f4e16301a762688b463668677d6121ae0 --- src/libbluray/hdmv/hdmv_vm.c | 43 +++++++++++++++++++++++++++++---------- src/libbluray/hdmv/mobj_parse.c | 30 +++++++++++++++++++++------ 2 files changed, 56 insertions(+), 17 deletions(-) diff --git a/src/libbluray/hdmv/hdmv_vm.c b/src/libbluray/hdmv/hdmv_vm.c index cb9afe5..f188cf9 100644 --- a/src/libbluray/hdmv/hdmv_vm.c +++ b/src/libbluray/hdmv/hdmv_vm.c @@ -1,6 +1,6 @@ /* * This file is part of libbluray - * Copyright (C) 2010-2012 Petri Hintukainen <[email protected]> + * Copyright (C) 2010-2014 Petri Hintukainen <[email protected]> * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -244,6 +244,11 @@ HDMV_VM *hdmv_vm_init(const char *disc_root, BD_REGISTERS *regs, INDX_ROOT *indx HDMV_VM *p = calloc(1, sizeof(HDMV_VM)); char *file; + if (!p) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + return NULL; + } + /* read movie objects */ file = str_printf("%s/BDMV/MovieObject.bdmv", disc_root); p->movie_objects = mobj_parse(file); @@ -1088,6 +1093,31 @@ int hdmv_vm_select_object(HDMV_VM *p, int object) return result; } +static int _set_object(HDMV_VM *p, int num_nav_cmds, void *nav_cmds) +{ + MOBJ_OBJECT *ig_object = calloc(1, sizeof(MOBJ_OBJECT)); + if (!ig_object) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + return -1; + } + + ig_object->num_cmds = num_nav_cmds; + ig_object->cmds = calloc(num_nav_cmds, sizeof(MOBJ_CMD)); + if (!ig_object->cmds) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + X_FREE(ig_object); + return -1; + } + + memcpy(ig_object->cmds, nav_cmds, num_nav_cmds * sizeof(MOBJ_CMD)); + + p->pc = 0; + p->ig_object = ig_object; + p->object = ig_object; + + return 0; +} + int hdmv_vm_set_object(HDMV_VM *p, int num_nav_cmds, void *nav_cmds) { int result = -1; @@ -1098,16 +1128,7 @@ int hdmv_vm_set_object(HDMV_VM *p, int num_nav_cmds, void *nav_cmds) _free_ig_object(p); if (nav_cmds && num_nav_cmds > 0) { - MOBJ_OBJECT *ig_object = calloc(1, sizeof(MOBJ_OBJECT)); - ig_object->num_cmds = num_nav_cmds; - ig_object->cmds = calloc(num_nav_cmds, sizeof(MOBJ_CMD)); - memcpy(ig_object->cmds, nav_cmds, num_nav_cmds * sizeof(MOBJ_CMD)); - - p->pc = 0; - p->ig_object = ig_object; - p->object = ig_object; - - result = 0; + result = _set_object(p, num_nav_cmds, nav_cmds); } bd_mutex_unlock(&p->mutex); diff --git a/src/libbluray/hdmv/mobj_parse.c b/src/libbluray/hdmv/mobj_parse.c index adc4ec2..d9db0b0 100644 --- a/src/libbluray/hdmv/mobj_parse.c +++ b/src/libbluray/hdmv/mobj_parse.c @@ -87,6 +87,10 @@ static int _mobj_parse_object(BITSTREAM *bs, MOBJ_OBJECT *obj) obj->num_cmds = bs_read(bs, 16); obj->cmds = calloc(obj->num_cmds, sizeof(MOBJ_CMD)); + if (!obj->cmds) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + return 0; + } for (i = 0; i < obj->num_cmds; i++) { uint8_t buf[12]; @@ -101,12 +105,14 @@ void mobj_free(MOBJ_OBJECTS **p) { if (p && *p) { - int i; - for (i = 0 ; i < (*p)->num_objects; i++) { - X_FREE((*p)->objects[i].cmds); - } + if ((*p)->objects) { + int i; + for (i = 0 ; i < (*p)->num_objects; i++) { + X_FREE((*p)->objects[i].cmds); + } - X_FREE((*p)->objects); + X_FREE((*p)->objects); + } X_FREE(*p); } @@ -143,12 +149,21 @@ static MOBJ_OBJECTS *_mobj_parse(const char *file_name) goto error; } + objects = calloc(1, sizeof(MOBJ_OBJECTS)); + if (!objects) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + goto error; + } + bs_skip(&bs, 32); /* reserved */ num_objects = bs_read(&bs, 16); - objects = calloc(1, sizeof(MOBJ_OBJECTS)); objects->num_objects = num_objects; objects->objects = calloc(num_objects, sizeof(MOBJ_OBJECT)); + if (!objects->objects) { + BD_DEBUG(DBG_CRIT, "out of memory\n"); + goto error; + } for (i = 0; i < objects->num_objects; i++) { if (!_mobj_parse_object(&bs, &objects->objects[i])) { @@ -175,6 +190,9 @@ MOBJ_OBJECTS *mobj_parse(const char *file_name) if (!objects) { size_t len = strlen(file_name); char *backup = malloc(len + 8); + if (!backup) { + return NULL; + } strcpy(backup, file_name); strcpy(backup + len - 16, "BACKUP/MovieObject.bdmv"); _______________________________________________ libbluray-devel mailing list [email protected] https://mailman.videolan.org/listinfo/libbluray-devel
