Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

3 files changed, 7 insertions, 2 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1694,97 +1694,100 @@ void CSoundFile::FrequencyToTranspose(MODINSTRUMENT *psmp)
         int ftune = f2t & 0x7F;
         if (ftune > 80)
         {
                 transp++;
                 ftune -= 128;
         }
         if (transp > 127) transp = 127;
         if (transp < -127) transp = -127;
         psmp->RelativeTone = transp;
         psmp->nFineTune = ftune;
 }
 
 
 void CSoundFile::CheckCPUUsage(UINT nCPU)
 //---------------------------------------
 {
         if (nCPU > 100) nCPU = 100;
         gnCPUUsage = nCPU;
         if (nCPU < 90)
         {
                 m_dwSongFlags &= ~SONG_CPUVERYHIGH;
         } else
         if ((m_dwSongFlags & SONG_CPUVERYHIGH) && (nCPU >= 94))
         {
                 UINT i=MAX_CHANNELS;
                 while (i >= 8)
                 {
                         i--;
                         if (Chn[i].nLength)
                         {
                                 Chn[i].nLength = Chn[i].nPos = 0;
                                 nCPU -= 2;
                                 if (nCPU < 94) break;
                         }
                 }
         } else
         if (nCPU > 90)
         {
                 m_dwSongFlags |= SONG_CPUVERYHIGH;
         }
 }
 
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
         if (nPat >= MAX_PATTERNS) return FALSE;
-        if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        if (lpszName)
+                lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        else
+                return FALSE;
         szName[MAX_PATTERNNAME-1] = 0;
         if (!m_lpszPatternNames) m_nPatternNames = 0;
         if (nPat >= m_nPatternNames)
         {
                 if (!lpszName[0]) return TRUE;
                 UINT len = (nPat+1)*MAX_PATTERNNAME;
                 char *p = new char[len];   // changed from CHAR
                 if (!p) return FALSE;
                 memset(p, 0, len);
                 if (m_lpszPatternNames)
                 {
                         memcpy(p, m_lpszPatternNames, m_nPatternNames * MAX_PATTERNNAME);
                         delete m_lpszPatternNames;
                         m_lpszPatternNames = NULL;
                 }
                 m_lpszPatternNames = p;
                 m_nPatternNames = nPat + 1;
         }
         memcpy(m_lpszPatternNames + nPat * MAX_PATTERNNAME, szName, MAX_PATTERNNAME);
         return TRUE;
 }
 
 
 BOOL CSoundFile::GetPatternName(UINT nPat, LPSTR lpszName, UINT cbSize) const
 //---------------------------------------------------------------------------
 {
         if ((!lpszName) || (!cbSize)) return FALSE;
         lpszName[0] = 0;
         if (cbSize > MAX_PATTERNNAME) cbSize = MAX_PATTERNNAME;
         if ((m_lpszPatternNames) && (nPat < m_nPatternNames))
         {
                 memcpy(lpszName, m_lpszPatternNames + nPat * MAX_PATTERNNAME, cbSize);
                 lpszName[cbSize-1] = 0;
                 return TRUE;
         }
         return FALSE;
 }
 
 
 #ifndef FASTSOUNDLIB
 
 UINT CSoundFile::DetectUnusedSamples(BOOL *pbIns)
 //-----------------------------------------------
 {
         UINT nExt = 0;
 
         if (!pbIns) return 0;
         if (m_nInstruments)
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -181,98 +181,100 @@ static int _vds_init(vorbis_dsp_state *v,vorbis_info *vi){
   v->W=0;  /* current window size */
 
   /* initialize all the mapping/backend lookups */
   b->mode=(vorbis_look_mapping **)_ogg_calloc(ci->modes,sizeof(*b->mode));
   for(i=0;i<ci->modes;i++){
     int mapnum=ci->mode_param[i]->mapping;
     int maptype=ci->map_type[mapnum];
     b->mode[i]=_mapping_P[maptype]->look(v,ci->mode_param[i],
                                          ci->map_param[mapnum]);
   }
   return(0);
 }
 
 int vorbis_synthesis_restart(vorbis_dsp_state *v){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci;
 
   if(!v->backend_state)return -1;
   if(!vi)return -1;
   ci=vi->codec_setup;
   if(!ci)return -1;
 
   v->centerW=ci->blocksizes[1]/2;
   v->pcm_current=v->centerW;
   
   v->pcm_returned=-1;
   v->granulepos=-1;
   v->sequence=-1;
   ((private_state *)(v->backend_state))->sample_count=-1;
 
   return(0);
 }
 
 int vorbis_synthesis_init(vorbis_dsp_state *v,vorbis_info *vi){
   _vds_init(v,vi);
   vorbis_synthesis_restart(v);
 
   return(0);
 }
 
 void vorbis_dsp_clear(vorbis_dsp_state *v){
   int i;
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
+      if (vi) {
       for(i=0;i<vi->channels;i++)
         if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
       for(i=0;i<ci->modes;i++){
         int mapnum=ci->mode_param[i]->mapping;
         int maptype=ci->map_type[mapnum];
         if(b && b->mode)_mapping_P[maptype]->free_look(b->mode[i]);
       }
     }
 
     if(b){
       if(b->mode)_ogg_free(b->mode);    
       _ogg_free(b);
     }
     
     memset(v,0,sizeof(*v));
   }
 }
 
 /* Unlike in analysis, the window is only partially applied for each
    block.  The time domain envelope is not yet handled at the point of
    calling (as it relies on the previous block). */
 
 int vorbis_synthesis_blockin(vorbis_dsp_state *v,vorbis_block *vb){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci=(codec_setup_info *)vi->codec_setup;
   private_state *b=v->backend_state;
   int i,j;
 
   if(v->pcm_current>v->pcm_returned  && v->pcm_returned!=-1)return(OV_EINVAL);
 
   v->lW=v->W;
   v->W=vb->W;
   v->nW=-1;
 
   if((v->sequence==-1)||
      (v->sequence+1 != vb->sequence)){
     v->granulepos=-1; /* out of sequence; lose count */
     b->sample_count=-1;
   }
 
   v->sequence=vb->sequence;
   
   if(vb->pcm){  /* no pcm to process if vorbis_synthesis_trackonly 
                    was called on block */
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -52,99 +52,99 @@ static int tagcompare(const char *s1, const char *s2, int n){
   }
   return 0;
 }
 
 char *vorbis_comment_query(vorbis_comment *vc, char *tag, int count){
   long i;
   int found = 0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+ 1);
 
   strcpy(fulltag, tag);
   strcat(fulltag, "=");
   
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen)){
       if(count == found)
         /* We return a pointer to the data, not a copy */
               return vc->user_comments[i] + taglen;
       else
         found++;
     }
   }
   return NULL; /* didn't find anything */
 }
 
 int vorbis_comment_query_count(vorbis_comment *vc, char *tag){
   int i,count=0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+1);
   strcpy(fulltag,tag);
   strcat(fulltag, "=");
 
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen))
       count++;
   }
 
   return count;
 }
 
 void vorbis_comment_clear(vorbis_comment *vc){
   if(vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
         if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
-  }
   memset(vc,0,sizeof(*vc));
 }
+}
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
   return ci ? ci->blocksizes[zo] : -1;
 }
 
 /* used by synthesis, which has a full, alloced vi */
 void vorbis_info_init(vorbis_info *vi){
   memset(vi,0,sizeof(*vi));
   vi->codec_setup=(codec_setup_info *)_ogg_calloc(1,sizeof(codec_setup_info));
 }
 
 void vorbis_info_clear(vorbis_info *vi){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   int i;
 
   if(ci){
 
     for(i=0;i<ci->modes;i++)
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);
 
     for(i=0;i<ci->maps;i++) /* unpack does the range checking */
       _mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);
 
     for(i=0;i<ci->floors;i++) /* unpack does the range checking */
       _floor_P[ci->floor_type[i]]->free_info(ci->floor_param[i]);
     
     for(i=0;i<ci->residues;i++) /* unpack does the range checking */
       _residue_P[ci->residue_type[i]]->free_info(ci->residue_param[i]);
 
     for(i=0;i<ci->books;i++){
       if(ci->book_param[i]){
         /* knows if the book was not alloced */
         vorbis_staticbook_destroy(ci->book_param[i]);
       }
       if(ci->fullbooks)
         vorbis_book_clear(ci->fullbooks+i);
     }
     if(ci->fullbooks)
         _ogg_free(ci->fullbooks);
     
     _ogg_free(ci);
   }
 
   memset(vi,0,sizeof(*vi));
 }