More checking for memory allocation failures.

8 files changed, 56 insertions, 6 deletions

diff --git a/src/demuxers/demux_4xm.c b/src/demuxers/demux_4xm.c
index 24aee1ac4..b06651456 100644
--- a/src/demuxers/demux_4xm.c
+++ b/src/demuxers/demux_4xm.c
@@ -159,7 +159,7 @@ static int open_fourxm_file(demux_fourxm_t *fourxm) {
   /* read the whole header */
   header_size = _X_LE_32(&preview[4]) - 4;
   header = xine_xmalloc(header_size);
-  if (fourxm->input->read(fourxm->input, header, header_size) != header_size) {
+  if (!header || fourxm->input->read(fourxm->input, header, header_size) != header_size) {
     free(header);
     return 0;
   }
diff --git a/src/demuxers/demux_avi.c b/src/demuxers/demux_avi.c
index 6bb0b289c..656e4662a 100644
--- a/src/demuxers/demux_avi.c
+++ b/src/demuxers/demux_avi.c
@@ -973,6 +973,10 @@ static avi_t *AVI_init(demux_avi_t *this) {
         xine_waveformatex *wavex;
         
         wavex = (xine_waveformatex *)malloc(n);
+        if (!wavex) {
+          this->AVI_errno = AVI_ERR_NO_MEM;
+          return 0;
+        }
         memcpy((void *)wavex, hdrl_data+i, n);
         _x_waveformatex_le2me( wavex );
 
@@ -1237,6 +1241,9 @@ static avi_t *AVI_init(demux_avi_t *this) {
           /* read from file */
           chunk_start = en = malloc (AVI->video_superindex->aIndex[j].dwSize+hdrl_len);
 
+          if (!chunk_start)
+             ERR_EXIT(AVI_ERR_NO_MEM);
+
           if (this->input->seek(this->input, AVI->video_superindex->aIndex[j].qwOffset, SEEK_SET) == (off_t)-1) {
              lprintf("cannot seek to 0x%" PRIx64 "\n", AVI->video_superindex->aIndex[j].qwOffset);
              free(chunk_start);
@@ -1308,6 +1315,9 @@ static avi_t *AVI_init(demux_avi_t *this) {
           /* read from file */
           chunk_start = en = malloc (audio->audio_superindex->aIndex[j].dwSize+hdrl_len);
 
+          if (!chunk_start)
+            ERR_EXIT(AVI_ERR_NO_MEM);
+
           if (this->input->seek(this->input, audio->audio_superindex->aIndex[j].qwOffset, SEEK_SET) == (off_t)-1) {
             lprintf("cannot seek to 0x%" PRIx64 "\n", audio->audio_superindex->aIndex[j].qwOffset);
             free(chunk_start);
diff --git a/src/demuxers/demux_flac.c b/src/demuxers/demux_flac.c
index c3d547cdb..b4c5edb2d 100644
--- a/src/demuxers/demux_flac.c
+++ b/src/demuxers/demux_flac.c
@@ -166,6 +166,8 @@ static int open_flac_file(demux_flac_t *flac) {
       flac->seekpoint_count = block_length / FLAC_SEEKPOINT_SIZE;
       flac->seekpoints = calloc(flac->seekpoint_count,
         sizeof(flac_seekpoint_t));
+      if (flac->seekpoint_count && !flac->seekpoints)
+        return 0;
       for (i = 0; i < flac->seekpoint_count; i++) {
         if (flac->input->read(flac->input, buffer, FLAC_SEEKPOINT_SIZE) != FLAC_SEEKPOINT_SIZE)
           return 0;
diff --git a/src/demuxers/demux_iff.c b/src/demuxers/demux_iff.c
index d914405db..0856eec1a 100644
--- a/src/demuxers/demux_iff.c
+++ b/src/demuxers/demux_iff.c
@@ -401,7 +401,7 @@ static int read_iff_chunk(demux_iff_t *this) {
           this->cmap_num                = junk_size / PIC_SIZE_OF_COLOR_REGISTER;
           this->cmap                    = (ColorRegister *)xine_xmalloc(junk_size);
           this->video_send_palette      = 1;
-          if (this->input->read(this->input, (char *)this->cmap, junk_size) != junk_size)
+          if (!this->cmap || this->input->read(this->input, (char *)this->cmap, junk_size) != junk_size)
             return 0;
           break;
         case IFF_GRAB_CHUNK:
@@ -709,11 +709,19 @@ static int demux_iff_send_chunk(demux_plugin_t *this_gen) {
       /* load the whole chunk into the buffer */
       if (this->audio_buffer_filled == 0) {
         if (this->audio_interleave_buffer_size > 0)
+        {
           this->audio_interleave_buffer =
                 xine_xmalloc(this->audio_interleave_buffer_size);
+          if (!this->audio_interleave_buffer)
+            return this->status = DEMUX_FINISHED;
+        }
         if (this->audio_read_buffer_size > 0)
+        {
           this->audio_read_buffer       =
                     xine_xmalloc(this->audio_read_buffer_size);
+          if (!this->audio_read_buffer)
+            return this->status = DEMUX_FINISHED;
+        }
         if (this->audio_read_buffer) {
           if (this->input->read(this->input, this->audio_read_buffer,
               this->data_size) != this->data_size) {
diff --git a/src/demuxers/demux_ipmovie.c b/src/demuxers/demux_ipmovie.c
index cd21896c0..12640e662 100644
--- a/src/demuxers/demux_ipmovie.c
+++ b/src/demuxers/demux_ipmovie.c
@@ -283,9 +283,10 @@ static int process_ipmovie_chunk(demux_ipmovie_t *this) {
         this->bih.biWidth = _X_LE_16(&scratch[0]) * 8;
         this->bih.biHeight = _X_LE_16(&scratch[2]) * 8;
         /* set up staging area for decode map */
-        this->decode_map_size = (this->bih.biWidth * this->bih.biHeight) /
-          (8 * 8) / 2;
+        this->decode_map_size = (this->bih.biWidth / 8) * (this->bih.biHeight / 8) / 2;
         this->decode_map = xine_xmalloc(this->decode_map_size);
+        if (!this->decode_map)
+          this->status = DEMUX_FINISHED;
         lprintf("video resolution: %d x %d\n",
           this->bih.biWidth, this->bih.biHeight);
         break;
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c
index 695059c09..e28952b23 100644
--- a/src/demuxers/demux_qt.c
+++ b/src/demuxers/demux_qt.c
@@ -896,6 +896,11 @@ static qt_error parse_trak_atom (qt_trak *trak,
     current_atom_size = _X_BE_32(&trak_atom[i - 4]);	
     current_atom = _X_BE_32(&trak_atom[i]);
 
+    if (current_atom_size > trak_atom_size - i) {
+      last_error = QT_NOT_A_VALID_FILE;
+      goto free_trak;
+    }
+
     if (current_atom == TKHD_ATOM) {
       trak->flags = _X_BE_16(&trak_atom[i + 6]);
     } else if (current_atom == ELST_ATOM) {
@@ -969,6 +974,10 @@ static qt_error parse_trak_atom (qt_trak *trak,
           trak->stsd_atoms[k].video.properties_atom_size = current_stsd_atom_size - 4;
           trak->stsd_atoms[k].video.properties_atom = 
             xine_xmalloc(trak->stsd_atoms[k].video.properties_atom_size);
+          if (!trak->stsd_atoms[k].video.properties_atom) {
+            last_error = QT_NO_MEMORY;
+            goto free_trak;
+          }
           memcpy(trak->stsd_atoms[k].video.properties_atom, &trak_atom[atom_pos],
             trak->stsd_atoms[k].video.properties_atom_size);
 
@@ -1108,6 +1117,10 @@ static qt_error parse_trak_atom (qt_trak *trak,
           trak->stsd_atoms[k].audio.properties_atom_size = current_stsd_atom_size - 4;
           trak->stsd_atoms[k].audio.properties_atom = 
             xine_xmalloc(trak->stsd_atoms[k].audio.properties_atom_size);
+          if (!trak->stsd_atoms[k].audio.properties_atom) {
+            last_error = QT_NO_MEMORY;
+            goto free_trak;
+          }
           memcpy(trak->stsd_atoms[k].audio.properties_atom, &trak_atom[atom_pos],
             trak->stsd_atoms[k].audio.properties_atom_size);
 
@@ -1224,6 +1237,10 @@ static qt_error parse_trak_atom (qt_trak *trak,
             trak->stsd_atoms[k].audio.properties_atom_size = 36;
             trak->stsd_atoms[k].audio.properties_atom = 
               xine_xmalloc(trak->stsd_atoms[k].audio.properties_atom_size);
+            if (!trak->stsd_atoms[k].audio.properties_atom) {
+              last_error = QT_NO_MEMORY;
+              goto free_trak;
+            }
             memcpy(trak->stsd_atoms[k].audio.properties_atom, 
               &trak_atom[atom_pos + 0x20],
               trak->stsd_atoms[k].audio.properties_atom_size);
@@ -1245,6 +1262,10 @@ static qt_error parse_trak_atom (qt_trak *trak,
                 (current_atom_size >= (0x4C + wave_size))) {
               trak->stsd_atoms[k].audio.wave_size = wave_size;
               trak->stsd_atoms[k].audio.wave = xine_xmalloc(wave_size);
+              if (!trak->stsd_atoms[k].audio.wave) {
+                last_error = QT_NO_MEMORY;
+                goto free_trak;
+              }
               memcpy(trak->stsd_atoms[k].audio.wave, &trak_atom[atom_pos + 0x4C],
                      wave_size);
               _x_waveformatex_le2me(trak->stsd_atoms[k].audio.wave);
@@ -1314,8 +1335,16 @@ static qt_error parse_trak_atom (qt_trak *trak,
             j += mp4_read_descr_len( &trak_atom[j], &len );
             debug_atom_load("      decoder config is %d (0x%X) bytes long\n",
               len, len);
+            if (len > current_atom_size - (j - i)) {
+              last_error = QT_NOT_A_VALID_FILE;
+              goto free_trak;
+            }
             trak->decoder_config = realloc(trak->decoder_config, len);
             trak->decoder_config_len = len;
+            if (!trak->decoder_config) {
+              last_error = QT_NO_MEMORY;
+              goto free_trak;
+            }
             memcpy(trak->decoder_config,&trak_atom[j],len);
           }
         }
diff --git a/src/demuxers/demux_realaudio.c b/src/demuxers/demux_realaudio.c
index 70c9b310a..b663912b8 100644
--- a/src/demuxers/demux_realaudio.c
+++ b/src/demuxers/demux_realaudio.c
@@ -103,7 +103,7 @@ static int open_ra_file(demux_ra_t *this) {
   /* allocate for and read header data */
   this->header = xine_xmalloc(this->header_size);
   
-  if (_x_demux_read_header(this->input, this->header, this->header_size) != this->header_size) {
+  if (!this->header || _x_demux_read_header(this->input, this->header, this->header_size) != this->header_size) {
     xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG, "demux_realaudio: unable to read header\n");
     free(this->header);
     return 0;
diff --git a/src/demuxers/demux_wav.c b/src/demuxers/demux_wav.c
index f654a0f3e..eb9b9a6ed 100644
--- a/src/demuxers/demux_wav.c
+++ b/src/demuxers/demux_wav.c
@@ -131,7 +131,7 @@ static int open_wav_file(demux_wav_t *this) {
   this->input->seek(this->input, wave_pos, SEEK_SET);
   this->wave = xine_xmalloc( this->wave_size );
 
-  if (this->input->read(this->input, (void *)this->wave, this->wave_size) !=
+  if (!this->wave || this->input->read(this->input, (void *)this->wave, this->wave_size) !=
     this->wave_size) {
     free (this->wave);
     return 0;