Hi,
>> [...]
>>> @@ -1678,6 +1931,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
>>> {
>>> unsigned int c;
>>> unsigned int channel_size;
>>> + unsigned int i;
>>> int num_buffers, ret;
>>> ALSDecContext *ctx = avctx->priv_data;
>>> ALSSpecificConfig *sconf = &ctx->sconf;
>>> @@ -1803,6 +2057,34 @@ static av_cold int decode_init(AVCodecContext *avctx)
>>> ctx->raw_buffer = av_mallocz_array(avctx->channels *
>>> channel_size, sizeof(*ctx->raw_buffer));
>>> ctx->raw_samples = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->raw_samples));
>>>
>>> + if (sconf->floating) {
>>> + ctx->acf = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->acf));
>>> + ctx->shift_value = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->shift_value));
>>> + ctx->last_shift_value = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->last_shift_value));
>>> + ctx->last_acf_mantissa = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->last_acf_mantissa));
>>> + ctx->raw_mantissa = av_malloc_array(avctx->channels,
>>> sizeof(*ctx->raw_mantissa));
>>> +
>>> + for (c = 0; c < avctx->channels; ++c) {
>>> + ctx->raw_mantissa[c] = av_malloc_array(ctx->cur_frame_length,
>>> sizeof(**ctx->raw_mantissa));
>>
>> using ctx->raw_mantissa without prior malloc failure check
>
> Should I keep this in a separate patch? It is unrelated to my patch.
This is not unrelated to your patch. You're allocating ctx->raw_mantissa array
and use the (maybe invalid) "allocated" array in the for loop. Test for a valid
pointer in ctx->raw_matissa before using it.
-Thilo
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
