[vlc-devel] commit: Zero tab entries when you allocate them ( Rémi Denis-Courmont )

[git version control]

vlc | branch: master | Rémi Denis-Courmont <rdenis at simphalempin.com> | Mon Sep 15 22:27:08 2008 +0300| [6d3c22f29e650b0d10b2116fe3145194d20b8b56] | committer: Rémi Denis-Courmont 

Zero tab entries when you allocate them

Fix unitialized pointer usages (possibly exploitable).

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=6d3c22f29e650b0d10b2116fe3145194d20b8b56
---

 modules/demux/playlist/xspf.c |   31 ++++++++++++++-----------------
 1 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/modules/demux/playlist/xspf.c b/modules/demux/playlist/xspf.c
index 3a7a4c3..fb4570a 100644
--- a/modules/demux/playlist/xspf.c
+++ b/modules/demux/playlist/xspf.c
@@ -498,25 +498,22 @@ static bool parse_track_node COMPLEX_INTERFACE
                 if( !strcmp( psz_name, psz_element ) )
                 {
                     FREE_ATT();
-                    if( p_demux->p_sys->i_identifier <
-                        p_demux->p_sys->i_tracklist_entries )
+                    if( p_demux->p_sys->i_identifier >=
+                           p_demux->p_sys->i_tracklist_entries )
                     {
-                        p_demux->p_sys->pp_tracklist[
-                            p_demux->p_sys->i_identifier ] = p_new_input;
-                    }
-                    else
-                    {
-                        if( p_demux->p_sys->i_identifier >
-                            p_demux->p_sys->i_tracklist_entries )
-                        {
-                            p_demux->p_sys->i_tracklist_entries =
-                                p_demux->p_sys->i_identifier;
-                        }
-                        INSERT_ELEM( p_demux->p_sys->pp_tracklist,
-                                     p_demux->p_sys->i_tracklist_entries,
-                                     p_demux->p_sys->i_tracklist_entries,
-                                     p_new_input );
+                        input_item_t **pp;
+                        pp = realloc( p_demux->p_sys->pp_tracklist,
+                            (p_demux->p_sys->i_identifier + 1) * sizeof(*pp) );
+                        if( !pp )
+                            return false;
+                        p_demux->p_sys->pp_tracklist = pp;
+                        while( p_demux->p_sys->i_identifier >=
+                               p_demux->p_sys->i_tracklist_entries )
+                            pp[p_demux->p_sys->i_tracklist_entries++] = NULL;
                     }
+
+                    p_demux->p_sys->pp_tracklist[
+                            p_demux->p_sys->i_identifier ] = p_new_input;
                     return true;
                 }
                 /* there MUST have been a start tag for that element name */