commit 369676deb1cbe560aaa253cb3f2cdd1ea0bd8d8b
author Dongwon Kang <dwkang@google.com> Thu Jul 13 18:41:31 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Sep 13 22:01:23 2017 +0000
tree f9f59654254021e5873efb346c6db3fedcb95206
parent 24b71b9d6cbffb9d9a1211e8a007f879c45cceaa

Use heap instead of alloca in res012.c

Test: run the poc with and without the patch
Bug: 62872015
Change-Id: I80448d4a08aac212e597433b413306a7593e9bff
(cherry picked from commit 70f5300e5abbb62f1902c1860d32219bf385d89d)

Tremolo/res012.c

diff --git a/Tremolo/res012.c b/Tremolo/res012.c
index 733a087..86b26a4 100644
--- a/Tremolo/res012.c
+++ b/Tremolo/res012.c
@@ -126,10 +126,13 @@
 
       if(used){
 
-        char **partword=(char **)alloca(ch*sizeof(*partword));
-        for(j=0;j<ch;j++)
-          partword[j]=(char *)alloca(partwords*partitions_per_word*
-                                     sizeof(*partword[j]));
+        char **partword=(char **)_ogg_calloc(ch,sizeof(*partword));
+        if(partword==NULL)goto cleanup1;
+        for(j=0;j<ch;j++){
+          partword[j]=(char *)_ogg_malloc(partwords*partitions_per_word*
+                                          sizeof(*partword[j]));
+          if(partword[j]==NULL)goto cleanup1;
+        }
 
         for(s=0;s<info->stages;s++){
 
@@ -147,7 +150,7 @@
 
               for(j=0;j<ch;j++){
                 int temp=vorbis_book_decode(phrasebook,&vd->opb);
-                if(temp==-1)goto eopbreak;
+                if(temp==-1)goto cleanup1;
 
                 /* this can be done quickly in assembly due to the quotient
                    always being at most six bits */
@@ -171,16 +174,23 @@
                   if(info->type){
                     if(vorbis_book_decodev_add(stagebook,in[j]+offset,&vd->opb,
                                                samples_per_partition,-8)==-1)
-                      goto eopbreak;
+                      goto cleanup1;
                   }else{
                     if(vorbis_book_decodevs_add(stagebook,in[j]+offset,&vd->opb,
                                                 samples_per_partition,-8)==-1)
-                      goto eopbreak;
+                      goto cleanup1;
                   }
                 }
               }
           }
         }
+ cleanup1:
+        if(partword){
+          for(j=0;j<ch;j++){
+            if(partword[j])_ogg_free(partword[j]);
+          }
+          _ogg_free(partword);
+        }
       }
     }
   }else{
@@ -193,11 +203,12 @@
       int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
 
       char *partword=
-        (char *)alloca(partwords*partitions_per_word*sizeof(*partword));
+        (char *)_ogg_malloc(partwords*partitions_per_word*sizeof(*partword));
+      if(partword==NULL)goto cleanup2;
       int beginoff=info->begin/ch;
 
       for(i=0;i<ch;i++)if(nonzero[i])break;
-      if(i==ch)return(0); /* no nonzero vectors */
+      if(i==ch)goto cleanup2; /* no nonzero vectors */
 
       samples_per_partition/=ch;
 
@@ -212,7 +223,7 @@
 
             /* fetch the partition word */
             temp=vorbis_book_decode(phrasebook,&vd->opb);
-            if(temp==-1)goto eopbreak;
+            if(temp==-1)goto cleanup2;
 
             /* this can be done quickly in assembly due to the quotient
                always being at most six bits */
@@ -233,14 +244,15 @@
                               i*samples_per_partition+beginoff,ch,
                               &vd->opb,
                               samples_per_partition,-8)==-1)
-                      goto eopbreak;
+                      goto cleanup2;
               }
           }
         }
       }
+ cleanup2:
+      if(partword)_ogg_free(partword);
     }
   }
- eopbreak:
 
   return 0;
 }