[vlc-commits] adpcm: do not abuse fmt_in.p_extra, fix double free

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Sat Jun  6 18:20:12 2015 +0300| [85a205b487c0dce7257d42c7e5046f48745a5030] | committer: Rémi Denis-Courmont

adpcm: do not abuse fmt_in.p_extra, fix double free

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=85a205b487c0dce7257d42c7e5046f48745a5030
---

 modules/codec/adpcm.c |   19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/modules/codec/adpcm.c b/modules/codec/adpcm.c
index b052965..e655c45 100644
--- a/modules/codec/adpcm.c
+++ b/modules/codec/adpcm.c
@@ -72,6 +72,7 @@ struct decoder_sys_t
     size_t              i_samplesperblock;
 
     date_t              end_date;
+    int16_t            *prev;
 };
 
 static void DecodeAdpcmMs    ( decoder_t *, int16_t *, uint8_t * );
@@ -164,10 +165,12 @@ static int OpenDecoder( vlc_object_t *p_this )
     }
 
     /* Allocate the memory needed to store the decoder's structure */
-    if( ( p_dec->p_sys = p_sys =
-          (decoder_sys_t *)malloc(sizeof(decoder_sys_t)) ) == NULL )
+    p_sys = malloc(sizeof(*p_sys));
+    if( unlikely(p_sys == NULL) )
         return VLC_ENOMEM;
 
+    p_sys->prev = NULL;
+
     switch( p_dec->fmt_in.i_codec )
     {
         case VLC_FOURCC('i','m','a', '4'): /* IMA ADPCM */
@@ -187,9 +190,9 @@ static int OpenDecoder( vlc_object_t *p_this )
             break;
         case VLC_FOURCC('X','A','J', 0): /* EA ADPCM */
             p_sys->codec = ADPCM_EA;
-            p_dec->fmt_in.p_extra = calloc( 2 * p_dec->fmt_in.audio.i_channels,
-                                            sizeof( int16_t ) );
-            if( p_dec->fmt_in.p_extra == NULL )
+            p_sys->prev = calloc( 2 * p_dec->fmt_in.audio.i_channels,
+                                  sizeof( int16_t ) );
+            if( unlikely(p_sys->prev == NULL) )
             {
                 free( p_sys );
                 return VLC_ENOMEM;
@@ -245,6 +248,7 @@ static int OpenDecoder( vlc_object_t *p_this )
              p_dec->fmt_in.audio.i_bitspersample, p_sys->i_block,
              p_sys->i_samplesperblock );
 
+    p_dec->p_sys = p_sys;
     p_dec->fmt_out.i_cat = AUDIO_ES;
     p_dec->fmt_out.i_codec = VLC_CODEC_S16N;
     p_dec->fmt_out.audio.i_rate = p_dec->fmt_in.audio.i_rate;
@@ -349,8 +353,7 @@ static void CloseDecoder( vlc_object_t *p_this )
     decoder_t *p_dec = (decoder_t *)p_this;
     decoder_sys_t *p_sys = p_dec->p_sys;
 
-    if( p_sys->codec == ADPCM_EA )
-        free( p_dec->fmt_in.p_extra );
+    free( p_sys->prev );
     free( p_sys );
 }
 
@@ -741,7 +744,7 @@ static void DecodeAdpcmEA( decoder_t *p_dec, int16_t *p_sample,
 
     unsigned chans = p_dec->fmt_in.audio.i_channels;
     const uint8_t *p_end = &p_buffer[p_sys->i_block];
-    int16_t *prev = (int16_t *)p_dec->fmt_in.p_extra;
+    int16_t *prev = p_sys->prev;
     int16_t *cur = prev + chans;
 
     for (unsigned c = 0; c < chans; c++)