Don't crash on corrupt filesandroid-4.4w_r1android-4.4.4_r2.0.1android-4.4.4_r2android-4.4.4_r1.0.1android-4.4.4_r1android-4.4.3_r1.1.0.1android-4.4.3_r1.1android-4.4.3_r1.0.1android-4.4.3_r1kitkat-wearkitkat-mr2.2-releasekitkat-mr2.1-releasekitkat-mr2-release

b/13652927

Change-Id: I33cd8e0ba9deda1c8aefe39120df90f42aead529

1 files changed, 10 insertions, 5 deletions

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 781ea10..27903b5 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -239,13 +239,14 @@ static int _make_decode_table(codebook *s,char *lengthlist,long quantvals,
   if (s->used_entries > INT_MAX/2 ||
       s->used_entries*2 > INT_MAX/((long) sizeof(*work)) - 1) return 1;
   /* Overallocate as above */
-  work=alloca((s->entries*2+1)*sizeof(*work));
-  if(_make_words(lengthlist,s->entries,work,quantvals,s,opb,maptype))return 1;
-  if (s->used_entries > INT_MAX/(s->dec_leafw+1)) return 1;
-  if (s->dec_nodeb && s->used_entries * (s->dec_leafw+1) > INT_MAX/s->dec_nodeb) return 1;
+  work=calloc((s->entries*2+1),sizeof(*work));
+  if (!work) return 1;
+  if(_make_words(lengthlist,s->entries,work,quantvals,s,opb,maptype)) goto error_out;
+  if (s->used_entries > INT_MAX/(s->dec_leafw+1)) goto error_out;
+  if (s->dec_nodeb && s->used_entries * (s->dec_leafw+1) > INT_MAX/s->dec_nodeb) goto error_out;
   s->dec_table=_ogg_malloc((s->used_entries*(s->dec_leafw+1)-2)*
 			   s->dec_nodeb);
-  if (!s->dec_table) return 1;
+  if (!s->dec_table) goto error_out;
 
   if(s->dec_leafw==1){
     switch(s->dec_nodeb){
@@ -329,7 +330,11 @@ static int _make_decode_table(codebook *s,char *lengthlist,long quantvals,
     }
   }
 
+  free(work);
   return 0;
+error_out:
+  free(work);
+  return 1;
 }
 
 /* most of the time, entries%dimensions == 0, but we need to be