Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

3 files changed, 9 insertions, 4 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1718,49 +1718,52 @@ void CSoundFile::CheckCPUUsage(UINT nCPU)
                 UINT i=MAX_CHANNELS;
                 while (i >= 8)
                 {
                         i--;
                         if (Chn[i].nLength)
                         {
                                 Chn[i].nLength = Chn[i].nPos = 0;
                                 nCPU -= 2;
                                 if (nCPU < 94) break;
                         }
                 }
         } else
         if (nCPU > 90)
         {
                 m_dwSongFlags |= SONG_CPUVERYHIGH;
         }
 }
 
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
         if (nPat >= MAX_PATTERNS) return FALSE;
-        if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        if (lpszName)
+                lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        else
+                return FALSE;
         szName[MAX_PATTERNNAME-1] = 0;
         if (!m_lpszPatternNames) m_nPatternNames = 0;
         if (nPat >= m_nPatternNames)
         {
                 if (!lpszName[0]) return TRUE;
                 UINT len = (nPat+1)*MAX_PATTERNNAME;
                 char *p = new char[len];   // changed from CHAR
                 if (!p) return FALSE;
                 memset(p, 0, len);
                 if (m_lpszPatternNames)
                 {
                         memcpy(p, m_lpszPatternNames, m_nPatternNames * MAX_PATTERNNAME);
                         delete m_lpszPatternNames;
                         m_lpszPatternNames = NULL;
                 }
                 m_lpszPatternNames = p;
                 m_nPatternNames = nPat + 1;
         }
         memcpy(m_lpszPatternNames + nPat * MAX_PATTERNNAME, szName, MAX_PATTERNNAME);
         return TRUE;
 }
 
 
 BOOL CSoundFile::GetPatternName(UINT nPat, LPSTR lpszName, UINT cbSize) const
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -205,50 +205,52 @@ int vorbis_synthesis_restart(vorbis_dsp_state *v){
   
   v->pcm_returned=-1;
   v->granulepos=-1;
   v->sequence=-1;
   ((private_state *)(v->backend_state))->sample_count=-1;
 
   return(0);
 }
 
 int vorbis_synthesis_init(vorbis_dsp_state *v,vorbis_info *vi){
   _vds_init(v,vi);
   vorbis_synthesis_restart(v);
 
   return(0);
 }
 
 void vorbis_dsp_clear(vorbis_dsp_state *v){
   int i;
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-        if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if (vi) {
+        for(i=0;i<vi->channels;i++)
+          if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
       for(i=0;i<ci->modes;i++){
         int mapnum=ci->mode_param[i]->mapping;
         int maptype=ci->map_type[mapnum];
         if(b && b->mode)_mapping_P[maptype]->free_look(b->mode[i]);
       }
     }
 
     if(b){
       if(b->mode)_ogg_free(b->mode);    
       _ogg_free(b);
     }
     
     memset(v,0,sizeof(*v));
   }
 }
 
 /* Unlike in analysis, the window is only partially applied for each
    block.  The time domain envelope is not yet handled at the point of
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -76,50 +76,50 @@ char *vorbis_comment_query(vorbis_comment *vc, char *tag, int count){
 
 int vorbis_comment_query_count(vorbis_comment *vc, char *tag){
   int i,count=0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+1);
   strcpy(fulltag,tag);
   strcat(fulltag, "=");
 
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen))
       count++;
   }
 
   return count;
 }
 
 void vorbis_comment_clear(vorbis_comment *vc){
   if(vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
         if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
   return ci ? ci->blocksizes[zo] : -1;
 }
 
 /* used by synthesis, which has a full, alloced vi */
 void vorbis_info_init(vorbis_info *vi){
   memset(vi,0,sizeof(*vi));
   vi->codec_setup=(codec_setup_info *)_ogg_calloc(1,sizeof(codec_setup_info));
 }
 
 void vorbis_info_clear(vorbis_info *vi){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   int i;
 
   if(ci){
 
     for(i=0;i<ci->modes;i++)
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);