From e16267fd0633873c08c4af35b0a3592c37f921f0 Mon Sep 17 00:00:00 2001 From: Thibaut Mattern Date: Tue, 21 Mar 2006 07:39:18 +0000 Subject: [coverity] CID: 276 Checker: USE_AFTER_FREE (help) File: xine-lib/src/libxinevdec/bitplane.c Function: bitplane_decode_data Description: Double free of pointer "(this)->buf" in call to "free" CID: 171 Checker: RESOURCE_LEAK (help) File: xine-lib/src/libxinevdec/bitplane.c Function: bitplane_decode_byterun1 Description: Returned without freeing storage "uncompressed" CID: 34 Checker: FORWARD_NULL (help) File: xine-lib/src/libxinevdec/bitplane.c Function: bitplane_sdelta_opt_3 Description: Variable "ptr" tracked as NULL was dereferenced. CVS patchset: 7943 CVS date: 2006/03/21 07:39:18 --- src/libxinevdec/bitplane.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src/libxinevdec/bitplane.c b/src/libxinevdec/bitplane.c index d8801fe6a..4fe9877ef 100644 --- a/src/libxinevdec/bitplane.c +++ b/src/libxinevdec/bitplane.c @@ -28,7 +28,7 @@ * 8 (long and short) * - untested (found no testfiles) IFF-ANIM OPT 3, 4 and 6 * - * $Id: bitplane.c,v 1.11 2004/12/16 13:59:12 mroi Exp $ + * $Id: bitplane.c,v 1.12 2006/03/21 07:39:18 tmattern Exp $ */ #include @@ -260,15 +260,19 @@ static uint8_t *bitplane_decode_byterun1 (uint8_t *compressed, pixel_ptr < size_uncompressed ) { if( compressed[i] <= 127 ) { j = compressed[i++]; - if( (i+j) > size_compressed ) + if( (i+j) > size_compressed ) { + free(uncompressed); return NULL; + } for( ; (j >= 0) && (pixel_ptr < size_uncompressed); j-- ) { uncompressed[pixel_ptr++] = compressed[i++]; } } else if ( compressed[i] > 128 ) { j = 256 - compressed[i++]; - if( i >= size_compressed ) + if( i >= size_compressed ) { + free(uncompressed); return NULL; + } for( ; (j >= 0) && (pixel_ptr < size_uncompressed); j-- ) { uncompressed[pixel_ptr++] = compressed[i]; } @@ -432,8 +436,8 @@ static void bitplane_sdelta_opt_3 (bitplane_decoder_t *this) { data = (uint16_t *)(&this->buf[BE_32(&deltadata[palette_index])]); if( data != (uint16_t *)this->buf ) { /* This 8 Pointers are followd by another 8 */ -/* ptr = (uint16_t *)(&this->buf[BE_32(&deltadata[(palette_index+8)])]); -*/ + ptr = (uint16_t *)(&this->buf[BE_32(&deltadata[(palette_index+8)])]); + /* in this case, I think big/little endian is not important ;-) */ while( *data != 0xFFFF) { row_ptr = 0; @@ -1144,9 +1148,6 @@ static void bitplane_decode_data (video_decoder_t *this_gen, if (buf->decoder_flags & BUF_FLAG_STDHEADER) { /* need to initialize */ this->stream->video_out->open (this->stream->video_out, this->stream); - if(this->buf) - free(this->buf); - bih = (xine_bmiheader *) buf->content; this->width = (bih->biWidth + 15) & ~0x0f; this->height = bih->biHeight; -- cgit v1.2.3