FP2-1575: Fix allocation failure crash
Fix allocation failure crash
Bug: 20718524
Change-Id: I86dcaf7d7452ad892822ff96fbcc0908e035b118
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 27903b5..0ff3529 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -507,13 +507,12 @@
/* use dec_type 1: vector of packed values */
/* need quantized values before */
- s->q_val=alloca(sizeof(ogg_uint16_t)*quantvals);
+ s->q_val=calloc(sizeof(ogg_uint16_t), quantvals);
if (!s->q_val) goto _eofout;
for(i=0;i<quantvals;i++)
((ogg_uint16_t *)s->q_val)[i]=(ogg_uint16_t)oggpack_read(opb,s->q_bits);
if(oggpack_eop(opb)){
- s->q_val=0; /* cleanup must not free alloca memory */
goto _eofout;
}
@@ -523,12 +522,11 @@
s->dec_leafw=_determine_leaf_words(s->dec_nodeb,
(s->q_bits*s->dim+8)/8);
if(_make_decode_table(s,lengthlist,quantvals,opb,maptype)){
- s->q_val=0; /* cleanup must not free alloca memory */
goto _errout;
}
- s->q_val=0; /* about to go out of scope; _make_decode_table
- was using it */
+ free(s->q_val);
+ s->q_val=0;
}else{
/* use dec_type 2: packed vector of column offsets */
@@ -619,6 +617,7 @@
_eofout:
vorbis_book_clear(s);
free(lengthlist);
+ free(s->q_val);
return -1;
}