[FFmpeg-devel] [PATCH] oggdec: add various malloc and NULL checks

[Stefano Sabatini]

---
 libavformat/oggdec.c |   19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 92da175..61a71c6 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -59,9 +59,12 @@ static const struct ogg_codec * const ogg_codecs[] = {
 static int ogg_save(AVFormatContext *s)
 {
     struct ogg *ogg = s->priv_data;
+    int i;
     struct ogg_state *ost =
         av_malloc(sizeof (*ost) + (ogg->nstreams-1) * sizeof (*ogg->streams));
-    int i;
+
+    if (!ost)
+        return AVERROR(ENOMEM);
     ost->pos = avio_tell (s->pb);
     ost->curidx = ogg->curidx;
     ost->next = ogg->state;
@@ -71,6 +74,8 @@ static int ogg_save(AVFormatContext *s)
     for (i = 0; i < ogg->nstreams; i++){
         struct ogg_stream *os = ogg->streams + i;
         os->buf = av_malloc (os->bufsize);
+        if (!os->buf)
+            return AVERROR(ENOMEM);
         memset (os->buf, 0, os->bufsize);
         memcpy (os->buf, ost->streams[i].buf, os->bufpos);
     }
@@ -152,13 +157,17 @@ static int ogg_new_stream(AVFormatContext *s, uint32_t serial, int new_avstream)
     AVStream *st;
     struct ogg_stream *os;
 
-    ogg->streams = av_realloc (ogg->streams,
-                               ogg->nstreams * sizeof (*ogg->streams));
+    os = av_realloc(ogg->streams, ogg->nstreams * sizeof (*ogg->streams));
+    if (!os)
+        return AVERROR(ENOMEM);
+    ogg->streams = os;
     memset (ogg->streams + idx, 0, sizeof (*ogg->streams));
     os = ogg->streams + idx;
     os->serial = serial;
     os->bufsize = DECODER_BUFFER_SIZE;
     os->buf = av_malloc(os->bufsize);
+    if (!os->buf)
+        return AVERROR(ENOMEM);
     os->header = -1;
 
     if (new_avstream) {
@@ -175,8 +184,10 @@ static int ogg_new_stream(AVFormatContext *s, uint32_t serial, int new_avstream)
 static int ogg_new_buf(struct ogg *ogg, int idx)
 {
     struct ogg_stream *os = ogg->streams + idx;
-    uint8_t *nb = av_malloc(os->bufsize);
     int size = os->bufpos - os->pstart;
+    uint8_t *nb = av_malloc(os->bufsize);
+    if (!nb)
+        return AVERROR(ENOMEM);
     if(os->buf){
         memcpy(nb, os->buf + os->pstart, size);
         av_free(os->buf);
-- 
1.7.2.3