Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

3 files changed, 9 insertions, 4 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1646,193 +1646,196 @@ DWORD CSoundFile::TransposeToFrequency(int transp, int ftune)
         fscale
         fstp st(1)
         fmul st(1), st(0)
         faddp st(1), st(0)
         fistp freq
         }
         UINT derr = freq % 11025;
         if (derr <= 8) freq -= derr;
         if (derr >= 11015) freq += 11025-derr;
         derr = freq % 1000;
         if (derr <= 5) freq -= derr;
         if (derr >= 995) freq += 1000-derr;
         return freq;
 #endif
 }
 
 
 // returns 12*128*log2(freq/8363)
 int CSoundFile::FrequencyToTranspose(DWORD freq)
 //----------------------------------------------
 {
         //---GCCFIX:  Removed assembly.
         return int(1536*(log(freq/8363)/log(2)));
         
 #ifdef WIN32
         const float _f1_8363 = 1.0f / 8363.0f;
         const float _factor = 128 * 12;
         LONG result;
         
         if (!freq) return 0;
         _asm {
         fld _factor
         fild freq
         fld _f1_8363
         fmulp st(1), st(0)
         fyl2x
         fistp result
         }
         return result;
 #endif
 }
 
 
 void CSoundFile::FrequencyToTranspose(MODINSTRUMENT *psmp)
 //--------------------------------------------------------
 {
         int f2t = FrequencyToTranspose(psmp->nC4Speed);
         int transp = f2t >> 7;
         int ftune = f2t & 0x7F;
         if (ftune > 80)
         {
                 transp++;
                 ftune -= 128;
         }
         if (transp > 127) transp = 127;
         if (transp < -127) transp = -127;
         psmp->RelativeTone = transp;
         psmp->nFineTune = ftune;
 }
 
 
 void CSoundFile::CheckCPUUsage(UINT nCPU)
 //---------------------------------------
 {
         if (nCPU > 100) nCPU = 100;
         gnCPUUsage = nCPU;
         if (nCPU < 90)
         {
                 m_dwSongFlags &= ~SONG_CPUVERYHIGH;
         } else
         if ((m_dwSongFlags & SONG_CPUVERYHIGH) && (nCPU >= 94))
         {
                 UINT i=MAX_CHANNELS;
                 while (i >= 8)
                 {
                         i--;
                         if (Chn[i].nLength)
                         {
                                 Chn[i].nLength = Chn[i].nPos = 0;
                                 nCPU -= 2;
                                 if (nCPU < 94) break;
                         }
                 }
         } else
         if (nCPU > 90)
         {
                 m_dwSongFlags |= SONG_CPUVERYHIGH;
         }
 }
 
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
         if (nPat >= MAX_PATTERNS) return FALSE;
-        if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        if (lpszName)
+                lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        else
+                return FALSE;
         szName[MAX_PATTERNNAME-1] = 0;
         if (!m_lpszPatternNames) m_nPatternNames = 0;
         if (nPat >= m_nPatternNames)
         {
                 if (!lpszName[0]) return TRUE;
                 UINT len = (nPat+1)*MAX_PATTERNNAME;
                 char *p = new char[len];   // changed from CHAR
                 if (!p) return FALSE;
                 memset(p, 0, len);
                 if (m_lpszPatternNames)
                 {
                         memcpy(p, m_lpszPatternNames, m_nPatternNames * MAX_PATTERNNAME);
                         delete m_lpszPatternNames;
                         m_lpszPatternNames = NULL;
                 }
                 m_lpszPatternNames = p;
                 m_nPatternNames = nPat + 1;
         }
         memcpy(m_lpszPatternNames + nPat * MAX_PATTERNNAME, szName, MAX_PATTERNNAME);
         return TRUE;
 }
 
 
 BOOL CSoundFile::GetPatternName(UINT nPat, LPSTR lpszName, UINT cbSize) const
 //---------------------------------------------------------------------------
 {
         if ((!lpszName) || (!cbSize)) return FALSE;
         lpszName[0] = 0;
         if (cbSize > MAX_PATTERNNAME) cbSize = MAX_PATTERNNAME;
         if ((m_lpszPatternNames) && (nPat < m_nPatternNames))
         {
                 memcpy(lpszName, m_lpszPatternNames + nPat * MAX_PATTERNNAME, cbSize);
                 lpszName[cbSize-1] = 0;
                 return TRUE;
         }
         return FALSE;
 }
 
 
 #ifndef FASTSOUNDLIB
 
 UINT CSoundFile::DetectUnusedSamples(BOOL *pbIns)
 //-----------------------------------------------
 {
         UINT nExt = 0;
 
         if (!pbIns) return 0;
         if (m_nInstruments)
         {
                 memset(pbIns, 0, MAX_SAMPLES * sizeof(BOOL));
                 for (UINT ipat=0; ipat<MAX_PATTERNS; ipat++)
                 {
                         MODCOMMAND *p = Patterns[ipat];
                         if (p)
                         {
                                 UINT jmax = PatternSize[ipat] * m_nChannels;
                                 for (UINT j=0; j<jmax; j++, p++)
                                 {
                                         if ((p->note) && (p->note <= 120))
                                         {
                                                 if ((p->instr) && (p->instr < MAX_INSTRUMENTS))
                                                 {
                                                         INSTRUMENTHEADER *penv = Headers[p->instr];
                                                         if (penv)
                                                         {
                                                                 UINT n = penv->Keyboard[p->note-1];
                                                                 if (n < MAX_SAMPLES) pbIns[n] = TRUE;
                                                         }
                                                 } else
                                                 {
                                                         for (UINT k=1; k<=m_nInstruments; k++)
                                                         {
                                                                 INSTRUMENTHEADER *penv = Headers[k];
                                                                 if (penv)
                                                                 {
                                                                         UINT n = penv->Keyboard[p->note-1];
                                                                         if (n < MAX_SAMPLES) pbIns[n] = TRUE;
                                                                 }
                                                         }
                                                 }
                                         }
                                 }
                         }
                 }
                 for (UINT ichk=1; ichk<=m_nSamples; ichk++)
                 {
                         if ((!pbIns[ichk]) && (Ins[ichk].pSample)) nExt++;
                 }
         }
         return nExt;
 }
 
 
 BOOL CSoundFile::RemoveSelectedSamples(BOOL *pbIns)
 //-------------------------------------------------
 {
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -133,194 +133,196 @@ void _vorbis_block_ripcord(vorbis_block *vb){
   /* pull the ripcord */
   vb->localtop=0;
   vb->reap=NULL;
 }
 
 int vorbis_block_clear(vorbis_block *vb){
   _vorbis_block_ripcord(vb);
   if(vb->localstore)_ogg_free(vb->localstore);
 
   memset(vb,0,sizeof(*vb));
   return(0);
 }
 
 static int _vds_init(vorbis_dsp_state *v,vorbis_info *vi){
   int i;
   codec_setup_info *ci=(codec_setup_info *)vi->codec_setup;
   private_state *b=NULL;
 
   memset(v,0,sizeof(*v));
   b=(private_state *)(v->backend_state=_ogg_calloc(1,sizeof(*b)));
 
   v->vi=vi;
   b->modebits=ilog(ci->modes);
 
   /* Vorbis I uses only window type 0 */
   b->window[0]=_vorbis_window(0,ci->blocksizes[0]/2);
   b->window[1]=_vorbis_window(0,ci->blocksizes[1]/2);
 
   /* finish the codebooks */
   if(!ci->fullbooks){
     ci->fullbooks=(codebook *)_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
     for(i=0;i<ci->books;i++){
       vorbis_book_init_decode(ci->fullbooks+i,ci->book_param[i]);
       /* decode codebooks are now standalone after init */
       vorbis_staticbook_destroy(ci->book_param[i]);
       ci->book_param[i]=NULL;
     }
   }
 
   v->pcm_storage=ci->blocksizes[1];
   v->pcm=(ogg_int32_t **)_ogg_malloc(vi->channels*sizeof(*v->pcm));
   v->pcmret=(ogg_int32_t **)_ogg_malloc(vi->channels*sizeof(*v->pcmret));
   for(i=0;i<vi->channels;i++)
     v->pcm[i]=(ogg_int32_t *)_ogg_calloc(v->pcm_storage,sizeof(*v->pcm[i]));
 
   /* all 1 (large block) or 0 (small block) */
   /* explicitly set for the sake of clarity */
   v->lW=0; /* previous window size */
   v->W=0;  /* current window size */
 
   /* initialize all the mapping/backend lookups */
   b->mode=(vorbis_look_mapping **)_ogg_calloc(ci->modes,sizeof(*b->mode));
   for(i=0;i<ci->modes;i++){
     int mapnum=ci->mode_param[i]->mapping;
     int maptype=ci->map_type[mapnum];
     b->mode[i]=_mapping_P[maptype]->look(v,ci->mode_param[i],
                                          ci->map_param[mapnum]);
   }
   return(0);
 }
 
 int vorbis_synthesis_restart(vorbis_dsp_state *v){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci;
 
   if(!v->backend_state)return -1;
   if(!vi)return -1;
   ci=vi->codec_setup;
   if(!ci)return -1;
 
   v->centerW=ci->blocksizes[1]/2;
   v->pcm_current=v->centerW;
   
   v->pcm_returned=-1;
   v->granulepos=-1;
   v->sequence=-1;
   ((private_state *)(v->backend_state))->sample_count=-1;
 
   return(0);
 }
 
 int vorbis_synthesis_init(vorbis_dsp_state *v,vorbis_info *vi){
   _vds_init(v,vi);
   vorbis_synthesis_restart(v);
 
   return(0);
 }
 
 void vorbis_dsp_clear(vorbis_dsp_state *v){
   int i;
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-        if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if (vi) {
+        for(i=0;i<vi->channels;i++)
+          if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
       for(i=0;i<ci->modes;i++){
         int mapnum=ci->mode_param[i]->mapping;
         int maptype=ci->map_type[mapnum];
         if(b && b->mode)_mapping_P[maptype]->free_look(b->mode[i]);
       }
     }
 
     if(b){
       if(b->mode)_ogg_free(b->mode);    
       _ogg_free(b);
     }
     
     memset(v,0,sizeof(*v));
   }
 }
 
 /* Unlike in analysis, the window is only partially applied for each
    block.  The time domain envelope is not yet handled at the point of
    calling (as it relies on the previous block). */
 
 int vorbis_synthesis_blockin(vorbis_dsp_state *v,vorbis_block *vb){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci=(codec_setup_info *)vi->codec_setup;
   private_state *b=v->backend_state;
   int i,j;
 
   if(v->pcm_current>v->pcm_returned  && v->pcm_returned!=-1)return(OV_EINVAL);
 
   v->lW=v->W;
   v->W=vb->W;
   v->nW=-1;
 
   if((v->sequence==-1)||
      (v->sequence+1 != vb->sequence)){
     v->granulepos=-1; /* out of sequence; lose count */
     b->sample_count=-1;
   }
 
   v->sequence=vb->sequence;
   
   if(vb->pcm){  /* no pcm to process if vorbis_synthesis_trackonly 
                    was called on block */
     int n=ci->blocksizes[v->W]/2;
     int n0=ci->blocksizes[0]/2;
     int n1=ci->blocksizes[1]/2;
     
     int thisCenter;
     int prevCenter;
     
     if(v->centerW){
       thisCenter=n1;
       prevCenter=0;
     }else{
       thisCenter=0;
       prevCenter=n1;
     }
     
     /* v->pcm is now used like a two-stage double buffer.  We don't want
        to have to constantly shift *or* adjust memory usage.  Don't
        accept a new block until the old is shifted out */
     
     /* overlap/add PCM */
     
     for(j=0;j<vi->channels;j++){
       /* the overlap/add section */
       if(v->lW){
         if(v->W){
           /* large/large */
           ogg_int32_t *pcm=v->pcm[j]+prevCenter;
           ogg_int32_t *p=vb->pcm[j];
           for(i=0;i<n1;i++)
             pcm[i]+=p[i];
         }else{
           /* large/small */
           ogg_int32_t *pcm=v->pcm[j]+prevCenter+n1/2-n0/2;
           ogg_int32_t *p=vb->pcm[j];
           for(i=0;i<n0;i++)
             pcm[i]+=p[i];
         }
       }else{
         if(v->W){
           /* small/large */
           ogg_int32_t *pcm=v->pcm[j]+prevCenter;
           ogg_int32_t *p=vb->pcm[j]+n1/2-n0/2;
           for(i=0;i<n0;i++)
             pcm[i]+=p[i];
           for(;i<n1/2+n0/2;i++)
             pcm[i]=p[i];
         }else{
           /* small/small */
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -4,194 +4,194 @@
  *                                                                  *
  * USE, DISTRIBUTION AND REPRODUCTION OF THIS LIBRARY SOURCE IS     *
  * GOVERNED BY A BSD-STYLE SOURCE LICENSE INCLUDED WITH THIS SOURCE *
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis 'TREMOR' SOURCE CODE IS (C) COPYRIGHT 1994-2003    *
  * BY THE Xiph.Org FOUNDATION http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: maintain the info structure, info <-> header packets
 
  ********************************************************************/
 
 /* general handling of the header and the vorbis_info structure (and
    substructures) */
 
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
 #include "ogg.h"
 #include "ivorbiscodec.h"
 #include "codec_internal.h"
 #include "codebook.h"
 #include "registry.h"
 #include "window.h"
 #include "misc.h"
 #include "os.h"
 
 /* helpers */
 static void _v_readstring(oggpack_buffer *o,char *buf,int bytes){
   while(bytes--){
     *buf++=oggpack_read(o,8);
   }
 }
 
 void vorbis_comment_init(vorbis_comment *vc){
   memset(vc,0,sizeof(*vc));
 }
 
 /* This is more or less the same as strncasecmp - but that doesn't exist
  * everywhere, and this is a fairly trivial function, so we include it */
 static int tagcompare(const char *s1, const char *s2, int n){
   int c=0;
   while(c < n){
     if(toupper(s1[c]) != toupper(s2[c]))
       return !0;
     c++;
   }
   return 0;
 }
 
 char *vorbis_comment_query(vorbis_comment *vc, char *tag, int count){
   long i;
   int found = 0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+ 1);
 
   strcpy(fulltag, tag);
   strcat(fulltag, "=");
   
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen)){
       if(count == found)
         /* We return a pointer to the data, not a copy */
               return vc->user_comments[i] + taglen;
       else
         found++;
     }
   }
   return NULL; /* didn't find anything */
 }
 
 int vorbis_comment_query_count(vorbis_comment *vc, char *tag){
   int i,count=0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+1);
   strcpy(fulltag,tag);
   strcat(fulltag, "=");
 
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen))
       count++;
   }
 
   return count;
 }
 
 void vorbis_comment_clear(vorbis_comment *vc){
   if(vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
         if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
   return ci ? ci->blocksizes[zo] : -1;
 }
 
 /* used by synthesis, which has a full, alloced vi */
 void vorbis_info_init(vorbis_info *vi){
   memset(vi,0,sizeof(*vi));
   vi->codec_setup=(codec_setup_info *)_ogg_calloc(1,sizeof(codec_setup_info));
 }
 
 void vorbis_info_clear(vorbis_info *vi){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   int i;
 
   if(ci){
 
     for(i=0;i<ci->modes;i++)
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);
 
     for(i=0;i<ci->maps;i++) /* unpack does the range checking */
       _mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);
 
     for(i=0;i<ci->floors;i++) /* unpack does the range checking */
       _floor_P[ci->floor_type[i]]->free_info(ci->floor_param[i]);
     
     for(i=0;i<ci->residues;i++) /* unpack does the range checking */
       _residue_P[ci->residue_type[i]]->free_info(ci->residue_param[i]);
 
     for(i=0;i<ci->books;i++){
       if(ci->book_param[i]){
         /* knows if the book was not alloced */
         vorbis_staticbook_destroy(ci->book_param[i]);
       }
       if(ci->fullbooks)
         vorbis_book_clear(ci->fullbooks+i);
     }
     if(ci->fullbooks)
         _ogg_free(ci->fullbooks);
     
     _ogg_free(ci);
   }
 
   memset(vi,0,sizeof(*vi));
 }
 
 /* Header packing/unpacking ********************************************/
 
 static int _vorbis_unpack_info(vorbis_info *vi,oggpack_buffer *opb){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   if(!ci)return(OV_EFAULT);
 
   vi->version=oggpack_read(opb,32);
   if(vi->version!=0)return(OV_EVERSION);
 
   vi->channels=oggpack_read(opb,8);
   vi->rate=oggpack_read(opb,32);
 
   vi->bitrate_upper=oggpack_read(opb,32);
   vi->bitrate_nominal=oggpack_read(opb,32);
   vi->bitrate_lower=oggpack_read(opb,32);
 
   ci->blocksizes[0]=1<<oggpack_read(opb,4);
   ci->blocksizes[1]=1<<oggpack_read(opb,4);
   
   if(vi->rate<1)goto err_out;
   if(vi->channels<1)goto err_out;
   if(ci->blocksizes[0]<64)goto err_out; 
   if(ci->blocksizes[1]<ci->blocksizes[0])goto err_out;
   if(ci->blocksizes[1]>8192)goto err_out;
   
   if(oggpack_read(opb,1)!=1)goto err_out; /* EOP check */
 
   return(0);
  err_out:
   vorbis_info_clear(vi);
   return(OV_EBADHEADER);
 }
 
 static int _vorbis_unpack_comment(vorbis_comment *vc,oggpack_buffer *opb){
   int i;
   int vendorlen=oggpack_read(opb,32);
   if(vendorlen<0)goto err_out;
   vc->vendor=(char *)_ogg_calloc(vendorlen+1,1);
   _v_readstring(opb,vc->vendor,vendorlen);
   vc->comments=oggpack_read(opb,32);
   if(vc->comments<0)goto err_out;
   vc->user_comments=(char **)_ogg_calloc(vc->comments+1,sizeof(*vc->user_comments));
   vc->comment_lengths=(int *)_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
             
   for(i=0;i<vc->comments;i++){
     int len=oggpack_read(opb,32);