commit 2e941e40ce76eb13b273479a4ee8fb6e40d33795
author Marco Nelissen <marcone@google.com> Thu Apr 30 13:45:34 2015 -0700
committer Marco Nelissen <marcone@google.com> Tue May 05 08:55:29 2015 -0700
tree 2cd7065c447e30afd3ef324023b2ea14bd84a503
parent 82cc1a4a5ee1c6f628c0ca9107d4162afa76d6c9

Fix allocation failure crash

Bug: 20718524
Change-Id: I86dcaf7d7452ad892822ff96fbcc0908e035b118

Tremolo/codebook.c

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 27903b5..0ff3529 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -507,13 +507,12 @@
 	/* use dec_type 1: vector of packed values */
 
 	/* need quantized values before  */
-	s->q_val=alloca(sizeof(ogg_uint16_t)*quantvals);
+	s->q_val=calloc(sizeof(ogg_uint16_t), quantvals);
 	if (!s->q_val) goto _eofout;
 	for(i=0;i<quantvals;i++)
 	  ((ogg_uint16_t *)s->q_val)[i]=(ogg_uint16_t)oggpack_read(opb,s->q_bits);
 
 	if(oggpack_eop(opb)){
-	  s->q_val=0; /* cleanup must not free alloca memory */
 	  goto _eofout;
 	}
 
@@ -523,12 +522,11 @@
 	s->dec_leafw=_determine_leaf_words(s->dec_nodeb,
 					   (s->q_bits*s->dim+8)/8);
 	if(_make_decode_table(s,lengthlist,quantvals,opb,maptype)){
-	  s->q_val=0; /* cleanup must not free alloca memory */
 	  goto _errout;
 	}
 
-	s->q_val=0; /* about to go out of scope; _make_decode_table
-                       was using it */
+	free(s->q_val);
+	s->q_val=0;
 
       }else{
 	/* use dec_type 2: packed vector of column offsets */
@@ -619,6 +617,7 @@
  _eofout:
   vorbis_book_clear(s);
   free(lengthlist);
+  free(s->q_val);
   return -1;
 }