pool/xine-lib
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xine-lib/xine-lib-CVE-2008-1482.diff

563 lines
22 KiB
Diff
Raw Blame History

# HG changeset patch
# User Darren Salt <linux@youmustbejoking.demon.co.uk>
# Date 1206237088 0
# Node ID a3f2772fd14b57e0557ef45797ff04c768657a7e
# Parent 65c1570fcf1dfcb8e5fc1d6b8ed8a296ab776e9d
Check for failure of various memory allocations. (SA29484)
Ref. http://aluigi.altervista.org/adv/xinehof-adv.txt
diff --git a/src/demuxers/demux_film.c b/src/demuxers/demux_film.c
--- a/src/demuxers/demux_film.c
+++ b/src/demuxers/demux_film.c
@@ -257,6 +257,8 @@ static int open_film_file(demux_film_t *
film->sample_count = _X_BE_32(&film_header[i + 12]);
film->sample_table =
xine_xmalloc(film->sample_count * sizeof(film_sample_t));
+ if (!film->sample_table)
+ goto film_abort;
for (j = 0; j < film->sample_count; j++) {
film->sample_table[j].sample_offset =
@@ -333,11 +335,14 @@ static int open_film_file(demux_film_t *
free(film->interleave_buffer);
film->interleave_buffer =
xine_xmalloc(film->sample_table[0].sample_size);
+ if (!film->interleave_buffer)
+ goto film_abort;
}
break;
default:
xine_log(film->stream->xine, XINE_LOG_MSG, _("unrecognized FILM chunk\n"));
+ film_abort:
free (film->interleave_buffer);
free (film->sample_table);
free (film_header);
diff --git a/src/demuxers/demux_flv.c b/src/demuxers/demux_flv.c
--- a/src/demuxers/demux_flv.c
+++ b/src/demuxers/demux_flv.c
@@ -85,7 +85,7 @@ typedef struct {
off_t filesize;
flv_index_entry_t *index;
- int num_indices;
+ unsigned int num_indices;
unsigned int cur_pts;
@@ -209,7 +209,7 @@ static int parse_flv_var(demux_flv_t *th
unsigned char *end = buf + size;
char *str;
unsigned char type;
- int len, num;
+ unsigned int len, num;
if (size < 1)
return 0;
@@ -283,6 +283,8 @@ static int parse_flv_var(demux_flv_t *th
str = tmp + 2;
tmp += len + 2;
len = parse_flv_var(this, tmp, end-tmp, str, len);
+ if (!len)
+ return 0;
tmp += len;
}
if (*tmp++ != FLV_DATA_TYPE_ENDOBJECT)
@@ -298,6 +300,8 @@ static int parse_flv_var(demux_flv_t *th
str = tmp + 2;
tmp += len + 2;
len = parse_flv_var(this, tmp, end-tmp, str, len);
+ if (!len)
+ return 0;
tmp += len;
}
break;
@@ -310,6 +314,8 @@ static int parse_flv_var(demux_flv_t *th
if (this->index)
free(this->index);
this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
+ if (!this->index)
+ return 0;
this->num_indices = num;
}
for (num = 0; num < this->num_indices && tmp < end; num++) {
@@ -326,6 +332,8 @@ static int parse_flv_var(demux_flv_t *th
if (this->index)
free(this->index);
this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
+ if (!this->index)
+ return 0;
this->num_indices = num;
}
for (num = 0; num < this->num_indices && tmp < end; num++) {
@@ -339,6 +347,8 @@ static int parse_flv_var(demux_flv_t *th
}
while (num-- && tmp < end) {
len = parse_flv_var(this, tmp, end-tmp, NULL, 0);
+ if (!len)
+ return 0;
tmp += len;
}
break;
@@ -360,7 +370,7 @@ static void parse_flv_script(demux_flv_t
unsigned char *end = buf + size;
int len;
- if (this->input->read(this->input, buf, size ) != size) {
+ if (!buf || this->input->read(this->input, buf, size ) != size) {
this->status = DEMUX_FINISHED;
free(buf);
return;
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c
--- a/src/demuxers/demux_qt.c
+++ b/src/demuxers/demux_qt.c
@@ -739,38 +739,52 @@ static void parse_meta_atom(qt_info *inf
if (current_atom == ART_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->artist = xine_xmalloc(string_size);
- strncpy(info->artist, &meta_atom[i + 20], string_size - 1);
- info->artist[string_size - 1] = 0;
+ if (info->artist) {
+ strncpy(info->artist, &meta_atom[i + 20], string_size - 1);
+ info->artist[string_size - 1] = 0;
+ }
} else if (current_atom == NAM_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->name = xine_xmalloc(string_size);
- strncpy(info->name, &meta_atom[i + 20], string_size - 1);
- info->name[string_size - 1] = 0;
+ if (info->name) {
+ strncpy(info->name, &meta_atom[i + 20], string_size - 1);
+ info->name[string_size - 1] = 0;
+ }
} else if (current_atom == ALB_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->album = xine_xmalloc(string_size);
- strncpy(info->album, &meta_atom[i + 20], string_size - 1);
- info->album[string_size - 1] = 0;
+ if (info->album) {
+ strncpy(info->album, &meta_atom[i + 20], string_size - 1);
+ info->album[string_size - 1] = 0;
+ }
} else if (current_atom == GEN_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->genre = xine_xmalloc(string_size);
- strncpy(info->genre, &meta_atom[i + 20], string_size - 1);
- info->genre[string_size - 1] = 0;
+ if (info->genre) {
+ strncpy(info->genre, &meta_atom[i + 20], string_size - 1);
+ info->genre[string_size - 1] = 0;
+ }
} else if (current_atom == TOO_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->comment = xine_xmalloc(string_size);
- strncpy(info->comment, &meta_atom[i + 20], string_size - 1);
- info->comment[string_size - 1] = 0;
+ if (info->comment) {
+ strncpy(info->comment, &meta_atom[i + 20], string_size - 1);
+ info->comment[string_size - 1] = 0;
+ }
} else if (current_atom == WRT_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->composer = xine_xmalloc(string_size);
- strncpy(info->composer, &meta_atom[i + 20], string_size - 1);
- info->composer[string_size - 1] = 0;
+ if (info->composer) {
+ strncpy(info->composer, &meta_atom[i + 20], string_size - 1);
+ info->composer[string_size - 1] = 0;
+ }
} else if (current_atom == DAY_ATOM) {
string_size = _X_BE_32(&meta_atom[i + 4]) - 16 + 1;
info->year = xine_xmalloc(string_size);
- strncpy(info->year, &meta_atom[i + 20], string_size - 1);
- info->year[string_size - 1] = 0;
+ if (info->year) {
+ strncpy(info->year, &meta_atom[i + 20], string_size - 1);
+ info->year[string_size - 1] = 0;
+ }
}
}
@@ -1549,32 +1563,29 @@ static qt_error parse_reference_atom (re
current_atom = _X_BE_32(&ref_atom[i]);
if (current_atom == RDRF_ATOM) {
+ size_t string_size = _X_BE_32(&ref_atom[i + 12]);
+ size_t url_offset = 0;
+
+ if (string_size >= current_atom_size || i + string_size >= ref_atom_size)
+ return QT_NOT_A_VALID_FILE;
/* if the URL starts with "http://", copy it */
- if (strncmp(&ref_atom[i + 16], "http://", 7) == 0
- || strncmp(&ref_atom[i + 16], "rtsp://", 7) == 0) {
-
- /* URL is spec'd to terminate with a NULL; don't trust it */
- ref->url = xine_xmalloc(_X_BE_32(&ref_atom[i + 12]) + 1);
- strncpy(ref->url, &ref_atom[i + 16], _X_BE_32(&ref_atom[i + 12]));
- ref->url[_X_BE_32(&ref_atom[i + 12]) - 1] = '\0';
-
- } else {
-
- int string_size;
-
- if (base_mrl)
- string_size = strlen(base_mrl) + _X_BE_32(&ref_atom[i + 12]) + 1;
- else
- string_size = _X_BE_32(&ref_atom[i + 12]) + 1;
-
- /* otherwise, append relative URL to base MRL */
- ref->url = xine_xmalloc(string_size);
- if (base_mrl)
- strcpy(ref->url, base_mrl);
- strncat(ref->url, &ref_atom[i + 16], _X_BE_32(&ref_atom[i + 12]));
- ref->url[string_size - 1] = '\0';
- }
+ if ( memcmp(&ref_atom[i + 16], "http://", 7) &&
+ memcmp(&ref_atom[i + 16], "rtsp://", 7) &&
+ base_mrl )
+ url_offset = strlen(base_mrl);
+
+ /* otherwise, append relative URL to base MRL */
+ string_size += url_offset;
+
+ ref->url = xine_xmalloc(string_size + 1);
+
+ if ( url_offset )
+ strcpy(ref->url, base_mrl);
+
+ memcpy(ref->url + url_offset, &ref_atom[i + 16], _X_BE_32(&ref_atom[i + 12]));
+
+ ref->url[string_size] = '\0';
debug_atom_load(" qt rdrf URL reference:\n %s\n", ref->url);
@@ -1993,8 +2004,12 @@ static void parse_moov_atom(qt_info *inf
info->references = (reference_t *)realloc(info->references,
info->reference_count * sizeof(reference_t));
- parse_reference_atom(&info->references[info->reference_count - 1],
- &moov_atom[i - 4], info->base_mrl);
+ error = parse_reference_atom(&info->references[info->reference_count - 1],
+ &moov_atom[i - 4], info->base_mrl);
+ if (error != QT_OK) {
+ info->last_error = error;
+ return;
+ }
} else {
debug_atom_load(" qt: unknown atom into the moov atom (0x%08X)\n", current_atom);
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c
--- a/src/demuxers/demux_real.c
+++ b/src/demuxers/demux_real.c
@@ -175,7 +175,8 @@ static void real_parse_index(demux_real_
off_t original_pos = this->input->get_current_pos(this->input);
unsigned char index_chunk_header[INDEX_CHUNK_HEADER_SIZE];
unsigned char index_record[INDEX_RECORD_SIZE];
- int i, entries, stream_num;
+ int i;
+ unsigned int entries, stream_num;
real_index_entry_t **index;
while(next_index_chunk) {
@@ -230,10 +231,11 @@ static void real_parse_index(demux_real_
}
}
- if(index && entries) {
+ if(index && entries)
/* Allocate memory for index */
*index = xine_xmalloc(entries * sizeof(real_index_entry_t));
+ if(index && entries && *index) {
/* Read index */
for(i = 0; i < entries; i++) {
if(this->input->read(this->input, index_record, INDEX_RECORD_SIZE)
diff --git a/src/demuxers/demux_wc3movie.c b/src/demuxers/demux_wc3movie.c
--- a/src/demuxers/demux_wc3movie.c
+++ b/src/demuxers/demux_wc3movie.c
@@ -389,6 +389,12 @@ static int open_mve_file(demux_mve_t *th
/* load the palette chunks */
this->palettes = xine_xmalloc(this->number_of_shots * PALETTE_SIZE *
sizeof(palette_entry_t));
+
+ if (!this->shot_offsets || !this->palettes) {
+ free (this->shot_offsets);
+ return 0;
+ }
+
for (i = 0; i < this->number_of_shots; i++) {
/* make sure there was a valid palette chunk preamble */
if (this->input->read(this->input, preamble, PREAMBLE_SIZE) !=
@@ -460,8 +466,9 @@ static int open_mve_file(demux_mve_t *th
case BNAM_TAG:
/* load the name into the stream attributes */
- title = realloc (title, chunk_size);
- if (this->input->read(this->input, title, chunk_size) != chunk_size) {
+ free (title);
+ title = malloc (chunk_size);
+ if (!title || this->input->read(this->input, title, chunk_size) != chunk_size) {
free (title);
free (this->palettes);
free (this->shot_offsets);
diff --git a/src/demuxers/ebml.c b/src/demuxers/ebml.c
--- a/src/demuxers/ebml.c
+++ b/src/demuxers/ebml.c
@@ -424,10 +424,15 @@ int ebml_check_header(ebml_parser_t *ebm
case EBML_ID_DOCTYPE: {
char *text = malloc(elem.len + 1);
+ if (!text)
+ return 0;
text[elem.len] = '\0';
if (!ebml_read_ascii (ebml, &elem, text))
- return 0;
+ {
+ free (text);
+ return 0;
+ }
lprintf("doctype: %s\n", text);
if (ebml->doctype)
# HG changeset patch
# User Darren Salt <linux@youmustbejoking.demon.co.uk>
# Date 1206287553 0
# Node ID 6f9e9feb84e595be0482395722bc784764713fb3
# Parent a3f2772fd14b57e0557ef45797ff04c768657a7e
Replace various malloc(x*sizeof(y)) with calloc(x,sizeof(y)).
diff --git a/src/demuxers/demux_film.c b/src/demuxers/demux_film.c
--- a/src/demuxers/demux_film.c
+++ b/src/demuxers/demux_film.c
@@ -256,7 +256,7 @@ static int open_film_file(demux_film_t *
film->frequency = _X_BE_32(&film_header[i + 8]);
film->sample_count = _X_BE_32(&film_header[i + 12]);
film->sample_table =
- xine_xmalloc(film->sample_count * sizeof(film_sample_t));
+ calloc(film->sample_count, sizeof(film_sample_t));
if (!film->sample_table)
goto film_abort;
for (j = 0; j < film->sample_count; j++) {
diff --git a/src/demuxers/demux_flac.c b/src/demuxers/demux_flac.c
--- a/src/demuxers/demux_flac.c
+++ b/src/demuxers/demux_flac.c
@@ -164,7 +164,7 @@ static int open_flac_file(demux_flac_t *
case 3:
lprintf ("SEEKTABLE metadata, %d bytes\n", block_length);
flac->seekpoint_count = block_length / FLAC_SEEKPOINT_SIZE;
- flac->seekpoints = xine_xmalloc(flac->seekpoint_count *
+ flac->seekpoints = calloc(flac->seekpoint_count,
sizeof(flac_seekpoint_t));
for (i = 0; i < flac->seekpoint_count; i++) {
if (flac->input->read(flac->input, buffer, FLAC_SEEKPOINT_SIZE) != FLAC_SEEKPOINT_SIZE)
diff --git a/src/demuxers/demux_flv.c b/src/demuxers/demux_flv.c
--- a/src/demuxers/demux_flv.c
+++ b/src/demuxers/demux_flv.c
@@ -313,7 +313,7 @@ static int parse_flv_var(demux_flv_t *th
if (!this->index || this->num_indices != num) {
if (this->index)
free(this->index);
- this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
+ this->index = calloc(num, sizeof(flv_index_entry_t));
if (!this->index)
return 0;
this->num_indices = num;
@@ -331,7 +331,7 @@ static int parse_flv_var(demux_flv_t *th
if (!this->index || this->num_indices != num) {
if (this->index)
free(this->index);
- this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
+ this->index = calloc(num, sizeof(flv_index_entry_t));
if (!this->index)
return 0;
this->num_indices = num;
diff --git a/src/demuxers/demux_mpgaudio.c b/src/demuxers/demux_mpgaudio.c
--- a/src/demuxers/demux_mpgaudio.c
+++ b/src/demuxers/demux_mpgaudio.c
@@ -460,7 +460,7 @@ static vbri_header_t* parse_vbri_header(
lprintf("entry_frames: %d\n", vbri->entry_frames);
if ((ptr + (vbri->toc_entries + 1) * vbri->entry_size) >= (buf + bufsize)) return 0;
- vbri->toc = xine_xmalloc (sizeof(int) * (vbri->toc_entries + 1));
+ vbri->toc = calloc (vbri->toc_entries + 1, sizeof (int));
if (!vbri->toc) {
free (vbri);
return NULL;
diff --git a/src/demuxers/demux_qt.c b/src/demuxers/demux_qt.c
--- a/src/demuxers/demux_qt.c
+++ b/src/demuxers/demux_qt.c
@@ -911,8 +911,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt elst atom (edit list atom): %d entries\n",
trak->edit_list_count);
- trak->edit_list_table = (edit_list_table_t *)xine_xmalloc(
- trak->edit_list_count * sizeof(edit_list_table_t));
+ trak->edit_list_table = (edit_list_table_t *)calloc(
+ trak->edit_list_count, sizeof(edit_list_table_t));
if (!trak->edit_list_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -947,7 +947,7 @@ static qt_error parse_trak_atom (qt_trak
/* allocate space for each of the properties unions */
trak->stsd_atoms_count = _X_BE_32(&trak_atom[i + 8]);
- trak->stsd_atoms = xine_xmalloc(trak->stsd_atoms_count * sizeof(properties_t));
+ trak->stsd_atoms = calloc(trak->stsd_atoms_count, sizeof(properties_t));
if (!trak->stsd_atoms) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1345,8 +1345,8 @@ static qt_error parse_trak_atom (qt_trak
/* allocate space and load table only if sample size is 0 */
if (trak->sample_size == 0) {
- trak->sample_size_table = (unsigned int *)malloc(
- trak->sample_size_count * sizeof(unsigned int));
+ trak->sample_size_table = (unsigned int *)calloc(
+ trak->sample_size_count, sizeof(unsigned int));
if (!trak->sample_size_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1376,8 +1376,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt stss atom (sample sync atom): %d sync samples\n",
trak->sync_sample_count);
- trak->sync_sample_table = (unsigned int *)malloc(
- trak->sync_sample_count * sizeof(unsigned int));
+ trak->sync_sample_table = (unsigned int *)calloc(
+ trak->sync_sample_count, sizeof(unsigned int));
if (!trak->sync_sample_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1405,8 +1405,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt stco atom (32-bit chunk offset atom): %d chunk offsets\n",
trak->chunk_offset_count);
- trak->chunk_offset_table = (int64_t *)malloc(
- trak->chunk_offset_count * sizeof(int64_t));
+ trak->chunk_offset_table = (int64_t *)calloc(
+ trak->chunk_offset_count, sizeof(int64_t));
if (!trak->chunk_offset_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1433,8 +1433,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt co64 atom (64-bit chunk offset atom): %d chunk offsets\n",
trak->chunk_offset_count);
- trak->chunk_offset_table = (int64_t *)malloc(
- trak->chunk_offset_count * sizeof(int64_t));
+ trak->chunk_offset_table = (int64_t *)calloc(
+ trak->chunk_offset_count, sizeof(int64_t));
if (!trak->chunk_offset_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1464,8 +1464,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt stsc atom (sample-to-chunk atom): %d entries\n",
trak->sample_to_chunk_count);
- trak->sample_to_chunk_table = (sample_to_chunk_table_t *)malloc(
- trak->sample_to_chunk_count * sizeof(sample_to_chunk_table_t));
+ trak->sample_to_chunk_table = (sample_to_chunk_table_t *)calloc(
+ trak->sample_to_chunk_count, sizeof(sample_to_chunk_table_t));
if (!trak->sample_to_chunk_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1499,8 +1499,8 @@ static qt_error parse_trak_atom (qt_trak
debug_atom_load(" qt stts atom (time-to-sample atom): %d entries\n",
trak->time_to_sample_count);
- trak->time_to_sample_table = (time_to_sample_table_t *)malloc(
- (trak->time_to_sample_count+1) * sizeof(time_to_sample_table_t));
+ trak->time_to_sample_table = (time_to_sample_table_t *)calloc(
+ trak->time_to_sample_count+1, sizeof(time_to_sample_table_t));
if (!trak->time_to_sample_table) {
last_error = QT_NO_MEMORY;
goto free_trak;
@@ -1697,8 +1697,7 @@ static qt_error build_frame_table(qt_tra
/* in this case, the total number of frames is equal to the number of
* entries in the sample size table */
trak->frame_count = trak->sample_size_count;
- trak->frames = (qt_frame *)malloc(
- trak->frame_count * sizeof(qt_frame));
+ trak->frames = (qt_frame *)calloc(trak->frame_count, sizeof(qt_frame));
if (!trak->frames)
return QT_NO_MEMORY;
trak->current_frame = 0;
@@ -1710,7 +1709,7 @@ static qt_error build_frame_table(qt_tra
pts_index_countdown =
trak->time_to_sample_table[pts_index].count;
- media_id_counts = xine_xmalloc(trak->stsd_atoms_count * sizeof(int));
+ media_id_counts = calloc(trak->stsd_atoms_count, sizeof(int));
if (!media_id_counts)
return QT_NO_MEMORY;
memset(media_id_counts, 0, trak->stsd_atoms_count * sizeof(int));
@@ -1848,8 +1847,7 @@ static qt_error build_frame_table(qt_tra
/* in this case, the total number of frames is equal to the number of
* chunks */
trak->frame_count = trak->chunk_offset_count;
- trak->frames = (qt_frame *)malloc(
- trak->frame_count * sizeof(qt_frame));
+ trak->frames = (qt_frame *)calloc(trak->frame_count, sizeof(qt_frame));
if (!trak->frames)
return QT_NO_MEMORY;
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c
--- a/src/demuxers/demux_real.c
+++ b/src/demuxers/demux_real.c
@@ -233,7 +233,7 @@ static void real_parse_index(demux_real_
if(index && entries)
/* Allocate memory for index */
- *index = xine_xmalloc(entries * sizeof(real_index_entry_t));
+ *index = calloc(entries, sizeof(real_index_entry_t));
if(index && entries && *index) {
/* Read index */
diff --git a/src/demuxers/demux_tta.c b/src/demuxers/demux_tta.c
--- a/src/demuxers/demux_tta.c
+++ b/src/demuxers/demux_tta.c
@@ -87,7 +87,7 @@ static int open_tta_file(demux_tta_t *th
return 0;
}
- this->seektable = xine_xmalloc(sizeof(uint32_t)*this->totalframes);
+ this->seektable = calloc(this->totalframes, sizeof(uint32_t));
this->input->read(this->input, this->seektable, sizeof(uint32_t)*this->totalframes);
/* Skip the CRC32 */
diff --git a/src/demuxers/demux_vmd.c b/src/demuxers/demux_vmd.c
--- a/src/demuxers/demux_vmd.c
+++ b/src/demuxers/demux_vmd.c
@@ -168,7 +168,7 @@ static int open_vmd_file(demux_vmd_t *th
return 0;
}
- this->frame_table = xine_xmalloc(this->frame_count * sizeof(vmd_frame_t));
+ this->frame_table = calloc(this->frame_count, sizeof(vmd_frame_t));
current_offset = this->data_start = _X_LE_32(&vmd_header[20]);
this->data_size = toc_offset - this->data_start;
diff --git a/src/demuxers/demux_wc3movie.c b/src/demuxers/demux_wc3movie.c
--- a/src/demuxers/demux_wc3movie.c
+++ b/src/demuxers/demux_wc3movie.c
@@ -378,7 +378,7 @@ static int open_mve_file(demux_mve_t *th
this->number_of_shots = _X_LE_32(&preamble[0]);
/* allocate space for the shot offset index and set offsets to 0 */
- this->shot_offsets = xine_xmalloc(this->number_of_shots * sizeof(off_t));
+ this->shot_offsets = calloc(this->number_of_shots, sizeof(off_t));
this->current_shot = 0;
for (i = 0; i < this->number_of_shots; i++)
this->shot_offsets[i] = 0;
@@ -387,7 +387,7 @@ static int open_mve_file(demux_mve_t *th
this->input->seek(this->input, 12, SEEK_CUR);
/* load the palette chunks */
- this->palettes = xine_xmalloc(this->number_of_shots * PALETTE_SIZE *
+ this->palettes = calloc(this->number_of_shots, PALETTE_SIZE *
sizeof(palette_entry_t));
if (!this->shot_offsets || !this->palettes) {
Reference in New Issue View Git Blame Copy Permalink