Fix for [oCERT-2008-004] multiple speex implementations insufficient boundary checks...

[vlc] / modules / codec / speex.c

diff --git a/modules/codec/speex.c b/modules/codec/speex.c
index 2548da4c301e7153533f8ef31859f906f49ac05b..83890bbfd615920c33a21a8173c24526511062ac 100644 (file)
--- a/modules/codec/speex.c
+++ b/modules/codec/speex.c
@@ -47,7 +47,7 @@
 struct decoder_sys_t
 {
     /* Module mode */
-    vlc_bool_t b_packetizer;
+    bool b_packetizer;
 
     /*
      * Input properties
@@ -148,7 +148,7 @@ static int OpenDecoder( vlc_object_t *p_this )
         return VLC_EGENERIC;
     }
     p_dec->p_sys->bits.buf_size = 0;
-    p_dec->p_sys->b_packetizer = VLC_FALSE;
+    p_dec->p_sys->b_packetizer = false;
     p_dec->p_sys->rtp_rate = p_dec->fmt_in.audio.i_rate;
 
     aout_DateSet( &p_sys->end_date, 0 );
@@ -194,7 +194,7 @@ static int OpenPacketizer( vlc_object_t *p_this )
 
     if( i_ret == VLC_SUCCESS )
     {
-        p_dec->p_sys->b_packetizer = VLC_TRUE;
+        p_dec->p_sys->b_packetizer = true;
         p_dec->fmt_out.i_codec = VLC_FOURCC('s','p','x',' ');
     }
 
@@ -357,7 +357,7 @@ static int ProcessInitialHeader( decoder_t *p_dec, ogg_packet *p_oggpacket )
         msg_Err( p_dec, "cannot read Speex header" );
         return VLC_EGENERIC;
     }
-    if( p_header->mode >= SPEEX_NB_MODES )
+    if( p_header->mode >= SPEEX_NB_MODES || p_header->mode < 0 )
     {
         msg_Err( p_dec, "mode number %d does not (yet/any longer) exist in "
                  "this version of libspeex.", p_header->mode );
@@ -637,7 +637,7 @@ static aout_buffer_t *DecodeRtpSpeexPacket( decoder_t *p_dec, block_t **pp_block
       were encountered.
     */
     i_decode_ret = speex_decode_int( p_sys->p_state, &p_sys->bits, 
-            (spx_int16_t*)p_aout_buffer->p_buffer );
+            (int16_t*)p_aout_buffer->p_buffer );
     if ( i_decode_ret < 0 )
     {
         msg_Err( p_dec, "Decoding failed. Perhaps we have a bad stream?" );
@@ -804,7 +804,7 @@ static void CloseDecoder( vlc_object_t *p_this )
         speex_bits_destroy( &p_sys->bits );
     }
 
-    if( p_sys->p_header ) free( p_sys->p_header );
+    free( p_sys->p_header );
     free( p_sys );
 }
 
@@ -1031,6 +1031,6 @@ static void CloseEncoder( vlc_object_t *p_this )
     speex_encoder_destroy( p_sys->p_state );
     speex_bits_destroy( &p_sys->bits );
 
-    if( p_sys->p_buffer ) free( p_sys->p_buffer );
+    free( p_sys->p_buffer );
     free( p_sys );
 }