Snap for 7080740 from 57e97210c850acfd3f1e4ad858e56fab00a4b226 to mainline-media-swcodec-releaseandroid-mainline-11.0.0_r40android11-mainline-media-swcodec-release

Change-Id: I72b57aaa7223035b7848b78ed3e8f5cca4e81dbf

6 files changed, 16 insertions, 6 deletions

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 8948cf3..43c4917 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -246,7 +246,7 @@ static int _make_decode_table(codebook *s,char *lengthlist,long quantvals,
      * This probably wastes a bit of space, but it shouldn't
      * impact behavior or size too much.
      */
-    s->dec_table=_ogg_malloc((s->entries*2+1)*sizeof(*work));
+    s->dec_table=_ogg_calloc((s->entries*2+1), sizeof(*work));
     if (!s->dec_table) return 1;
     /* +1 (rather than -2) is to accommodate 0 and 1 sized books,
        which are specialcased to nodeb==4 */
@@ -264,7 +264,7 @@ static int _make_decode_table(codebook *s,char *lengthlist,long quantvals,
   if(_make_words(lengthlist,s->entries,work,quantvals,s,opb,maptype)) goto error_out;
   if (s->used_entries > INT_MAX/(s->dec_leafw+1)) goto error_out;
   if (s->dec_nodeb && s->used_entries * (s->dec_leafw+1) > INT_MAX/s->dec_nodeb) goto error_out;
-  s->dec_table=_ogg_malloc((s->used_entries*(s->dec_leafw+1)-2)*
+  s->dec_table=_ogg_calloc((s->used_entries*(s->dec_leafw+1)-2),
                            s->dec_nodeb);
   if (!s->dec_table) goto error_out;
 
@@ -422,7 +422,7 @@ int vorbis_book_unpack(oggpack_buffer *opb,codebook *s){
 
   /* first the basic parameters */
   s->dim=oggpack_read(opb,16);
-  s->dec_buf=_ogg_malloc(sizeof(ogg_int32_t)*s->dim);
+  s->dec_buf=_ogg_calloc(s->dim, sizeof(ogg_int32_t));
   if (s->dec_buf == NULL)
       goto _errout;
   s->entries=oggpack_read(opb,24);
@@ -476,6 +476,7 @@ int vorbis_book_unpack(oggpack_buffer *opb,codebook *s){
       for(i=0;i<s->entries;){
         long num=oggpack_read(opb,_ilog(s->entries-i));
         if(num<0)goto _eofout;
+        if(length>32) goto _errout;
         for(j=0;j<num && i<s->entries;j++,i++)
           lengthlist[i]=(char)length;
         s->dec_maxlength=length;
diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c
index 7811aba..1a920a7 100644
--- a/Tremolo/floor1.c
+++ b/Tremolo/floor1.c
@@ -140,6 +140,7 @@ vorbis_info_floor *floor1_info_unpack (vorbis_info *vi,oggpack_buffer *opb){
   /* read the post list */
   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */
   rangebits=oggpack_read(opb,4);
+  if(rangebits < 0) goto err_out;
 
   for(j=0,k=0;j<info->partitions;j++)
     count+=info->klass[info->partitionclass[j]].class_dim;
diff --git a/Tremolo/framing.c b/Tremolo/framing.c
index ae6bb20..c9f1743 100644
--- a/Tremolo/framing.c
+++ b/Tremolo/framing.c
@@ -115,7 +115,7 @@ static ogg_buffer *_fetch_buffer(ogg_buffer_state *bs,long bytes){
   }else{
     /* allocate a new buffer */
     ob=_ogg_malloc(sizeof(*ob));
-    ob->data=_ogg_malloc(bytes<16?16:bytes);
+    ob->data=_ogg_calloc(bytes<16?16:bytes, 1);
     ob->size=bytes;
   }
 
diff --git a/Tremolo/mdct.c b/Tremolo/mdct.c
index 32b3525..1e4f44c 100644
--- a/Tremolo/mdct.c
+++ b/Tremolo/mdct.c
@@ -100,6 +100,7 @@ STIN void presymmetry(DATA_TYPE *in,int n2,int step){
   }while(aX>=bX);
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 /* 8 point butterfly (in place) */
 STIN void mdct_butterfly_8(DATA_TYPE *x){
 
@@ -123,6 +124,7 @@ STIN void mdct_butterfly_8(DATA_TYPE *x){
 	   MB();
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 /* 16 point butterfly (in place, 4 register) */
 STIN void mdct_butterfly_16(DATA_TYPE *x){
 
@@ -150,6 +152,7 @@ STIN void mdct_butterfly_16(DATA_TYPE *x){
 	   mdct_butterfly_8(x+8);
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 /* 32 point butterfly (in place, 4 register) */
 STIN void mdct_butterfly_32(DATA_TYPE *x){
 
@@ -271,6 +274,7 @@ STIN void mdct_bitreverse(DATA_TYPE *x,int n,int shift){
   }while(w>x);
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 STIN void mdct_step7(DATA_TYPE *x,int n,int step){
   DATA_TYPE   *w0    = x;
   DATA_TYPE   *w1    = x+(n>>1);
@@ -317,6 +321,7 @@ STIN void mdct_step7(DATA_TYPE *x,int n,int step){
 }
 #endif
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 STIN void mdct_step8(DATA_TYPE *x, int n, int step){
   LOOKUP_T *T;
   LOOKUP_T *V;
diff --git a/Tremolo/misc.h b/Tremolo/misc.h
index b75a6d8..903d16a 100644
--- a/Tremolo/misc.h
+++ b/Tremolo/misc.h
@@ -166,6 +166,7 @@ static inline ogg_int32_t MULT31_SHIFT15(ogg_int32_t x, ogg_int32_t y) {
 
 #else
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 static inline void XPROD32(ogg_int32_t  a, ogg_int32_t  b,
 			   ogg_int32_t  t, ogg_int32_t  v,
 			   ogg_int32_t *x, ogg_int32_t *y)
@@ -174,6 +175,7 @@ static inline void XPROD32(ogg_int32_t  a, ogg_int32_t  b,
   *y = MULT32(b, t) - MULT32(a, v);
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 static inline void XPROD31(ogg_int32_t  a, ogg_int32_t  b,
 			   ogg_int32_t  t, ogg_int32_t  v,
 			   ogg_int32_t *x, ogg_int32_t *y)
@@ -182,6 +184,7 @@ static inline void XPROD31(ogg_int32_t  a, ogg_int32_t  b,
   *y = MULT31(b, t) - MULT31(a, v);
 }
 
+__attribute__((no_sanitize("signed-integer-overflow")))
 static inline void XNPROD31(ogg_int32_t  a, ogg_int32_t  b,
 			    ogg_int32_t  t, ogg_int32_t  v,
 			    ogg_int32_t *x, ogg_int32_t *y)
diff --git a/Tremolo/vorbisfile.c b/Tremolo/vorbisfile.c
index f896b43..46bada6 100644
--- a/Tremolo/vorbisfile.c
+++ b/Tremolo/vorbisfile.c
@@ -243,8 +243,8 @@ static int _bisect_forward_serialno(OggVorbis_File *vf,
   if(searched>=end || ret<0){
     ogg_page_release(&og);
     vf->links=m+1;
-    vf->offsets=_ogg_malloc((vf->links+1)*sizeof(*vf->offsets));
-    vf->serialnos=_ogg_malloc(vf->links*sizeof(*vf->serialnos));
+    vf->offsets=_ogg_calloc((vf->links+1), sizeof(*vf->offsets));
+    vf->serialnos=_ogg_calloc(vf->links, sizeof(*vf->serialnos));
     vf->offsets[m+1]=searched;
   }else{
     ret=_bisect_forward_serialno(vf,next,vf->offset,