Changeset 38aaaeb38781b5087e8bf645c6aaf19520745093

Show
Ignore:
Timestamp:
05/10/08 20:01:11 (2 months ago)
Author:
Jean-Paul Saman <jpsaman@videolan.org>
git-committer:
Jean-Paul Saman <jpsaman@videolan.org> 1210442471 +0200
git-parent:

[594e6e22ceafa46b99baa2b2bfdc4012680d4f13]

git-author:
Jean-Paul Saman <jpsaman@videolan.org> 1210441481 +0200
Message:

Check malloc return value or risk overwritting not allocated memory.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/access/rtmp/rtmp_amf_flv.c

    r9f42721 r38aaaeb  
    224224const uint8_t FLV_VIDEO_FRAME_TYPE_INTER_FRAME = 0x20; 
    225225const uint8_t FLV_VIDEO_FRAME_TYPE_DISPOSABLE_INTER_FRAME = 0x30; 
     226 
    226227/***************************************************************************** 
    227228 * static RTMP functions: 
    …… 
    430431 
    431432    tmp_url = (char *) malloc( strlen( "rtmp://") + strlen( p_thread->url.psz_buffer ) + 1 ); 
     433    /* FIXME: Handle error case when malloc FAILS */ 
    432434    sprintf( tmp_url, "rtmp://%s", p_thread->url.psz_buffer ); 
    433435    tmp_buffer = amf_encode_object_variable( "tcUrl", 
    …… 
    782784 
    783785    tmp_buffer = (uint8_t *) malloc( sizeof( uint32_t ) * sizeof( uint8_t ) ); 
     786    if( !tmp_buffer ) return NULL; 
     787 
    784788    reply = hton32( reply ); 
    785789    memcpy( tmp_buffer, &reply, sizeof( uint32_t ) ); 
    …… 
    9981002        { 
    9991003            rtmp_packet = (rtmp_packet_t *) malloc( sizeof( rtmp_packet_t ) ); 
     1004            if( !rtmp_packet ) goto error; 
    10001005 
    10011006            rtmp_packet->stream_index = stream_index; 
    …… 
    10151020error: 
    10161021    msg_Err( p_thread, "rtmp_read_net_packet: net_Read error"); 
    1017  
    10181022    return NULL; 
    10191023} 
    …… 
    10431047rtmp_handler_null( rtmp_control_thread_t *p_thread, rtmp_packet_t *rtmp_packet ) 
    10441048{ 
     1049    VLC_UNUSED(p_thread); 
    10451050    free( rtmp_packet->body->body ); 
    10461051    free( rtmp_packet->body ); 
    …… 
    14561461 
    14571462    rtmp_packet = (rtmp_packet_t *) malloc( sizeof( rtmp_packet_t ) ); 
     1463    if( !rtmp_packet ) return NULL; 
     1464 
    14581465    interchunk_headers = body->length_body / p_thread->chunk_size_send; 
    14591466    if( body->length_body % p_thread->chunk_size_send == 0 ) 
    …… 
    15101517 
    15111518    rtmp_packet->body = (rtmp_body_t *) malloc( sizeof( rtmp_body_t ) ); 
     1519    if( !rtmp_packet->body ) 
     1520    { 
     1521       free( rtmp_packet ); 
     1522       return NULL; 
     1523    } 
    15121524 
    15131525    rtmp_packet->body->length_body = body->length_body; 
    15141526    rtmp_packet->body->length_buffer = body->length_body; 
    15151527    rtmp_packet->body->body = (uint8_t *) malloc( rtmp_packet->body->length_buffer * sizeof( uint8_t ) ); 
     1528    if( !rtmp_packet->body->body ) 
     1529    { 
     1530        free( rtmp_packet->body ); 
     1531        free( rtmp_packet ); 
     1532        return NULL; 
     1533    } 
    15161534    memcpy( rtmp_packet->body->body, body->body, rtmp_packet->body->length_body ); 
    15171535 
    …… 
    15581576 
    15591577    out = (uint8_t *) malloc( rtmp_packet->length_encoded * sizeof( uint8_t ) ); 
     1578    if( !out ) return NULL; 
     1579 
    15601580    interchunk_headers = rtmp_packet->body->length_body / p_thread->chunk_size_send; 
    15611581    if( rtmp_packet->body->length_body % p_thread->chunk_size_send == 0 ) 
    …… 
    18341854 
    18351855    description = (char *) malloc( strlen( "Playing and resetting ") + strlen( psz_media ) + strlen( "." ) + 1 ); 
     1856    /* FIXME: Handle error case when malloc FAILS */ 
     1857 
    18361858    sprintf( description, "Playing and resetting %s.", psz_media ); 
    18371859    tmp_buffer = amf_encode_object_variable( "description", 
    …… 
    19141936 
    19151937    description = (char *) malloc( strlen( "Started playing ") + strlen( psz_media ) + strlen( "." ) + 1 ); 
     1938    /* FIXME: Handle error case when MALLOC FAILS */ 
     1939 
    19161940    sprintf( description, "Started playing %s.", psz_media ); 
    19171941    tmp_buffer = amf_encode_object_variable( "description", 
    …… 
    20072031 
    20082032    rtmp_body = (rtmp_body_t *) malloc( sizeof( rtmp_body_t ) ); 
     2033    if( !rtmp_body ) return NULL; 
    20092034 
    20102035    rtmp_body->length_body = 0; 
    …… 
    20142039        rtmp_body->length_buffer = length_buffer; 
    20152040    rtmp_body->body = (uint8_t *) malloc( rtmp_body->length_buffer * sizeof( uint8_t ) ); 
    2016  
     2041    if( !rtmp_body->body ) 
     2042    { 
     2043        free( rtmp_body ); 
     2044        return NULL; 
     2045    } 
    20172046    return rtmp_body; 
    20182047} 
    …… 
    20432072rtmp_encode_ping( uint16_t type, uint32_t src_dst, uint32_t third_arg, uint32_t fourth_arg ) 
    20442073{ 
    2045     uint8_t *out; 
     2074    uint8_t *out = NULL; 
     2075    VLC_UNUSED(fourth_arg); 
    20462076 
    20472077    if( type == RTMP_PING_CLEAR_STREAM ) 
    …… 
    20522082    { 
    20532083        out = (uint8_t *) malloc( RTMP_PING_SIZE_BUFFER_TIME_CLIENT * sizeof( uint8_t ) ); 
    2054  
     2084        if( !out ) goto error; 
    20552085        third_arg = hton32( third_arg ); 
    20562086        memcpy( out + 6, &third_arg, sizeof( uint32_t ) ); 
    …… 
    20692099    { 
    20702100        out = (uint8_t *) malloc( RTMP_PING_SIZE_BUFFER_TIME_CLIENT * sizeof( uint8_t ) ); 
    2071  
     2101        if( !out ) goto error; 
    20722102        out[6] = 0x0D; out[7] = 0x0E; out[8] = 0x0A; out[9] = 0x0D; 
    20732103    } 
     2104 
     2105    if( !out ) goto error; 
    20742106 
    20752107    type = hton16( type ); 
    …… 
    20802112 
    20812113    return out; 
     2114 
     2115error: 
     2116    return NULL; 
    20822117} 
    20832118 
    …… 
    20952130 
    20962131        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); 
     2132        if( !out ) return NULL; 
    20972133         
    20982134        number = hton64( number ); 
    …… 
    21022138    { 
    21032139        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_BOOLEAN * sizeof( uint8_t ) ); 
     2140        if( !out ) return NULL; 
    21042141 
    21052142        out[0] = AMF_DATATYPE_BOOLEAN; 
    …… 
    21112148        length_psz = length_psz_cpy = strlen( (char *) value ); 
    21122149        out = (uint8_t *) malloc( ( AMF_DATATYPE_SIZE_STRING + length_psz ) * sizeof( uint8_t ) ); 
     2150        if( !out ) return NULL; 
    21132151 
    21142152        out[0] = AMF_DATATYPE_STRING; 
    …… 
    21192157    { 
    21202158        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_OBJECT * sizeof( uint8_t ) ); 
     2159        if( !out ) return NULL; 
    21212160 
    21222161        out[0] = AMF_DATATYPE_OBJECT; 
    …… 
    21242163    { 
    21252164        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NULL * sizeof( uint8_t ) ); 
     2165        if( !out ) return NULL; 
    21262166 
    21272167        out[0] = AMF_DATATYPE_NULL; 
    …… 
    21312171 
    21322172        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_MIXED_ARRAY * sizeof( uint8_t ) ); 
     2173        if( !out ) return NULL; 
    21332174 
    21342175        highest_index = hton32( highest_index ); 
    …… 
    21432184    { 
    21442185        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); 
     2186        if( !out ) return NULL; 
    21452187 
    21462188        out[0] = AMF_DATATYPE_NUMBER; 
    …… 
    21722214    { 
    21732215        out = (uint8_t *) malloc( AMF_DATATYPE_SIZE_NUMBER * sizeof( uint8_t ) ); 
     2216        if( !out ) return NULL; 
    21742217 
    21752218        out[0] = AMF_DATATYPE_NUMBER; 
    …… 
    21812224 
    21822225    out = (uint8_t *) malloc( ( AMF_DATATYPE_SIZE_OBJECT_VARIABLE + length_psz + length_value ) * sizeof( uint8_t ) ); 
     2226    if( !out ) return NULL; 
    21832227 
    21842228    length_psz = hton16( length_psz ); 
    …… 
    22292273 
    22302274    out = (char *) malloc( length + 1 ); /* '\0' terminated */ 
     2275    if( !out ) return NULL; 
    22312276 
    22322277    for(i = 0; i < length; i++)