Fix crash when osdmenu failed loading.

diff --git a/modules/misc/osd/osd_menu.c b/modules/misc/osd/osd_menu.c
index a370703deb433bb7bd902c876e149f66881b352f..2be6c92318c96758be14f1197f47de267de1d9e7 100644 (file)
--- a/modules/misc/osd/osd_menu.c
+++ b/modules/misc/osd/osd_menu.c
@@ -1,7 +1,7 @@
 /*****************************************************************************
  * parser.c : OSD import module
  *****************************************************************************
- * Copyright (C) 2007 M2X
+ * Copyright (C) 2007-2008 M2X
  * $Id$
  *
  * Authors: Jean-Paul Saman
@@ -120,6 +120,8 @@ void osd_ButtonFree( osd_menu_t *p_menu, osd_button_t *p_button )
     osd_button_t *p_next = NULL;
     osd_button_t *p_prev = NULL;
 
+    if( !p_current ) return;
+
     /* First walk to the end. */
     while( p_current->p_next )
     {
@@ -218,9 +220,11 @@ osd_state_t *osd_StateNew( osd_menu_t *p_menu, const char *psz_file,
     {
         p_state->p_pic = image_ReadUrl( p_menu->p_image, psz_file,
                                         &fmt_in, &fmt_out );
-
-        p_state->i_width  = p_state->p_pic->p[Y_PLANE].i_visible_pitch;
-        p_state->i_height = p_state->p_pic->p[Y_PLANE].i_visible_lines;
+        if( p_state->p_pic )
+        {
+            p_state->i_width  = p_state->p_pic->p[Y_PLANE].i_visible_pitch;
+            p_state->i_height = p_state->p_pic->p[Y_PLANE].i_visible_lines;
+        }
     }
 
     if( psz_state )
@@ -248,6 +252,8 @@ void osd_StatesFree( osd_menu_t *p_menu, osd_state_t *p_states )
     osd_state_t *p_next = NULL;
     osd_state_t *p_prev = NULL;
 
+    if( !p_state ) return;
+
     while( p_state->p_next )
     {
         p_next = p_state->p_next;

diff --git a/modules/misc/osd/simple.c b/modules/misc/osd/simple.c
index 41e795f65cfde1a9d97b10820035e1714ebf8394..b48ca3f7dc05d441c0b7e4704de9064ae1e53d92 100644 (file)
--- a/modules/misc/osd/simple.c
+++ b/modules/misc/osd/simple.c
@@ -1,7 +1,7 @@
 /*****************************************************************************
  * simple.c - The OSD Menu simple parser code.
  *****************************************************************************
- * Copyright (C) 2005-2007 M2X
+ * Copyright (C) 2005-2008 M2X
  * $Id$
  *
  * Authors: Jean-Paul Saman
@@ -51,7 +51,6 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     osd_button_t   *p_current = NULL; /* button currently processed */
     osd_button_t   *p_prev = NULL;    /* previous processed button */
 
-#define MAX_FILE_PATH 256
     FILE       *fd = NULL;
     int        result = 0;
 
@@ -71,7 +70,7 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     {
         char action[25] = "";
         char cmd[25] = "";
-        char path[MAX_FILE_PATH] = "";
+        char path[PATH_MAX] = "";
         char *psz_path = NULL;
         size_t i_len = 0;
         long pos = 0;
@@ -85,14 +84,14 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
             /* psz_path is not null and therefor &path[0] cannot be NULL
              * it might be null terminated.
              */
-            strncpy( &path[0], psz_path, MAX_FILE_PATH );
+            strncpy( &path[0], psz_path, PATH_MAX );
             free( psz_path );
             psz_path = NULL;
         }
         /* NULL terminate before asking the length of path[] */
-        path[MAX_FILE_PATH-1] = '\0';
+        path[PATH_MAX-1] = '\0';
         i_len = strlen(&path[0]);
-        if( i_len == MAX_FILE_PATH )
+        if( i_len == PATH_MAX )
             i_len--; /* truncate to prevent buffer overflow */
 #if defined(WIN32) || defined(UNDER_CE)
         if( (i_len > 0) && path[i_len] != '\\' )
@@ -153,7 +152,7 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
         char action[25] = "";
         char state[25]  = "";
         char file[256]  = "";
-        char path[512]  = "";
+        char path[PATH_MAX]  = "";
         int  i_x = 0;
         int  i_y = 0;
 
@@ -261,8 +260,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                             size_t i_path_size = strlen( p_menu->psz_path );
                             size_t i_file_size = strlen( &file[0] );
 
+                            if( (i_path_size + i_file_size >= PATH_MAX) ||
+                                (i_path_size >= PATH_MAX) )
+                                goto error;
+
                             strncpy( &path[0], p_menu->psz_path, i_path_size );
-                            strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                            strncpy( &path[i_path_size], &file[0],
+                                     PATH_MAX - (i_path_size + i_file_size) );
                             path[ i_path_size + i_file_size ] = '\0';
 
                             p_range_current = osd_StateNew( p_menu, &path[0], "pressed" );
@@ -366,8 +370,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                         size_t i_path_size = strlen( p_menu->psz_path );
                         size_t i_file_size = strlen( &file[0] );
 
+                        if( (i_path_size + i_file_size >= PATH_MAX) ||
+                            (i_path_size >= PATH_MAX) )
+                            goto error;
+
                         strncpy( &path[0], p_menu->psz_path, i_path_size );
-                        strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                        strncpy( &path[i_path_size], &file[0],
+                                 PATH_MAX - (i_path_size + i_file_size) );
                         path[ i_path_size + i_file_size ] = '\0';
 
                         p_range_current = osd_StateNew( p_menu, &path[0], "pressed" );
@@ -442,8 +451,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                 size_t i_path_size = strlen( p_menu->psz_path );
                 size_t i_file_size = strlen( &file[0] );
 
+                if( (i_path_size + i_file_size >= PATH_MAX) ||
+                    (i_path_size >= PATH_MAX) )
+                    goto error;
+
                 strncpy( &path[0], p_menu->psz_path, i_path_size );
-                strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                strncpy( &path[i_path_size], &file[0],
+                         PATH_MAX - (i_path_size + i_file_size) );
                 path[ i_path_size + i_file_size ] = '\0';
 
                 p_state_current = osd_StateNew( p_menu, &path[0], &state[0] );
@@ -489,7 +503,6 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     fclose( fd );
     return VLC_SUCCESS;
 
-#undef MAX_FILE_PATH
 error:
     msg_Err( p_menu, "parsing file failed (returned %d)", result );
     osd_MenuFree( p_menu );

diff --git a/src/osd/osd.c b/src/osd/osd.c
index 97ade75c2b917c16f4d38c9c587be1d9e3069bad..d78668e06272869bc7e6842f629d4b2254ee8eb2 100644 (file)
--- a/src/osd/osd.c
+++ b/src/osd/osd.c
@@ -1,7 +1,7 @@
 /*****************************************************************************
  * osd.c - The OSD Menu core code.
  *****************************************************************************
- * Copyright (C) 2005-2007 M2X
+ * Copyright (C) 2005-2008 M2X
  * $Id$
  *
  * Authors: Jean-Paul Saman <jpsaman #_at_# m2x dot nl>
@@ -38,10 +38,6 @@
 
 #undef OSD_MENU_DEBUG
 
-#if 0
-static const char *ppsz_button_states[] = { "unselect", "select", "pressed" };
-#endif
-
 /*****************************************************************************
  * Local prototypes
  *****************************************************************************/
@@ -74,6 +70,7 @@ static osd_menu_t *osd_ParserLoad( vlc_object_t *p_this, const char *psz_file )
     if( !p_menu )
         return NULL;
 
+    p_menu->p_parser = NULL;
     vlc_object_attach( p_menu, p_this->p_libvlc );
 
     /* Stuff needed for Parser */
@@ -110,12 +107,12 @@ static void osd_ParserUnload( osd_menu_t *p_menu )
 {
     if( p_menu->p_image )
         image_HandlerDelete( p_menu->p_image );
-    if( p_menu->psz_file )
-        free( p_menu->psz_file );
 
     if( p_menu->p_parser )
         module_Unneed( p_menu, p_menu->p_parser );
 
+    free( p_menu->psz_file );
+
     vlc_object_detach( p_menu );
     vlc_object_release( p_menu );
 }
@@ -123,7 +120,7 @@ static void osd_ParserUnload( osd_menu_t *p_menu )
 /**
  * Change state on an osd_button_t.
  *
- * This function selects the specified state and returns a pointer to it. The
+ * This function selects the specified state and returns a pointer vlc_custom_createto it. The
  * following states are currently supported:
  * \see OSD_BUTTON_UNSELECT
  * \see OSD_BUTTON_SELECT
@@ -173,7 +170,7 @@ osd_menu_t *__osd_MenuCreate( vlc_object_t *p_this, const char *psz_file )
 
         /* Parse configuration file */
         p_osd = osd_ParserLoad( p_this, psz_file );
-        if( !p_osd )
+        if( !p_osd || !p_osd->p_state )
             goto error;
 
         /* Setup default button (first button) */
@@ -207,16 +204,7 @@ osd_menu_t *__osd_MenuCreate( vlc_object_t *p_this, const char *psz_file )
     return p_osd;
 
 error:
-    msg_Err( p_this, "creating OSD menu object failed" );
-
-    if( p_osd->p_image )
-        image_HandlerDelete( p_osd->p_image );
-    if( p_osd->psz_file )
-        free( p_osd->psz_file );
-
-    vlc_object_detach( p_osd );
-    vlc_object_release( p_osd );
-    vlc_mutex_unlock( lockval.p_address );
+    __osd_MenuDelete( p_this, p_osd );
     return NULL;
 }