Diff of /Modules/audioop.c [278842] .. [5c26cf] Maximize Restore

Repo status: analyzing...

  Switch to side-by-side view

--- a/Modules/audioop.c
+++ b/Modules/audioop.c
@@ -674,7 +674,7 @@
 audioop_tostereo(PyObject *self, PyObject *args)
 {
 	signed char *cp, *ncp;
-	int len, size, val1, val2, val = 0;
+	int len, new_len, size, val1, val2, val = 0;
 	double fac1, fac2, fval, maxval;
 	PyObject *rv;
 	int i;
@@ -690,7 +690,14 @@
 		return 0;
 	}
     
-	rv = PyString_FromStringAndSize(NULL, len*2);
+	new_len = len*2;
+	if (new_len < 0) {
+		PyErr_SetString(PyExc_MemoryError,
+				"not enough memory for output buffer");
+		return 0;
+	}
+
+	rv = PyString_FromStringAndSize(NULL, new_len);
 	if ( rv == 0 )
 		return 0;
 	ncp = (signed char *)PyString_AsString(rv);
@@ -853,7 +860,7 @@
 {
 	signed char *cp;
 	unsigned char *ncp;
-	int len, size, size2, val = 0;
+	int len, new_len, size, size2, val = 0;
 	PyObject *rv;
 	int i, j;
 
@@ -867,7 +874,13 @@
 		return 0;
 	}
     
-	rv = PyString_FromStringAndSize(NULL, (len/size)*size2);
+	new_len = (len/size)*size2;
+	if (new_len < 0) {
+		PyErr_SetString(PyExc_MemoryError,
+				"not enough memory for output buffer");
+		return 0;
+	}
+	rv = PyString_FromStringAndSize(NULL, new_len);
 	if ( rv == 0 )
 		return 0;
 	ncp = (unsigned char *)PyString_AsString(rv);
@@ -903,6 +916,7 @@
 	int chan, d, *prev_i, *cur_i, cur_o;
 	PyObject *state, *samps, *str, *rv = NULL;
 	int bytes_per_frame;
+	size_t alloc_size;
 
 	weightA = 1;
 	weightB = 0;
@@ -944,8 +958,14 @@
 	inrate /= d;
 	outrate /= d;
 
-	prev_i = (int *) malloc(nchannels * sizeof(int));
-	cur_i = (int *) malloc(nchannels * sizeof(int));
+	alloc_size = sizeof(int) * (unsigned)nchannels;
+	if (alloc_size < nchannels) {
+		PyErr_SetString(PyExc_MemoryError,
+				"not enough memory for output buffer");
+		return 0;
+	}
+	prev_i = (int *) malloc(alloc_size);
+	cur_i = (int *) malloc(alloc_size);
 	if (prev_i == NULL || cur_i == NULL) {
 		(void) PyErr_NoMemory();
 		goto exit;
@@ -1116,7 +1136,7 @@
 	unsigned char *cp;
 	unsigned char cval;
 	signed char *ncp;
-	int len, size, val;
+	int len, new_len, size, val;
 	PyObject *rv;
 	int i;
 
@@ -1129,12 +1149,18 @@
 		return 0;
 	}
     
-	rv = PyString_FromStringAndSize(NULL, len*size);
+	new_len = len*size;
+	if (new_len < 0) {
+		PyErr_SetString(PyExc_MemoryError,
+			"not enough memory for output buffer");
+		return 0;
+	}
+	rv = PyString_FromStringAndSize(NULL, new_len);
 	if ( rv == 0 )
 		return 0;
 	ncp = (signed char *)PyString_AsString(rv);
     
-	for ( i=0; i < len*size; i += size ) {
+	for ( i=0; i < new_len; i += size ) {
 		cval = *cp++;
 		val = st_ulaw_to_linear(cval);
 	
@@ -1259,7 +1285,7 @@
 {
 	signed char *cp;
 	signed char *ncp;
-	int len, size, valpred, step, delta, index, sign, vpdiff;
+	int len, new_len, size, valpred, step, delta, index, sign, vpdiff;
 	PyObject *rv, *str, *state;
 	int i, inputbuffer = 0, bufferstep;
 
@@ -1281,7 +1307,13 @@
 	} else if ( !PyArg_Parse(state, "(ii)", &valpred, &index) )
 		return 0;
     
-	str = PyString_FromStringAndSize(NULL, len*size*2);
+	new_len = len*size*2;
+	if (new_len < 0) {
+		PyErr_SetString(PyExc_MemoryError,
+				"not enough memory for output buffer");
+		return 0;
+	}
+	str = PyString_FromStringAndSize(NULL, new_len);
 	if ( str == 0 )
 		return 0;
 	ncp = (signed char *)PyString_AsString(str);
@@ -1289,7 +1321,7 @@
 	step = stepsizeTable[index];
 	bufferstep = 0;
     
-	for ( i=0; i < len*size*2; i += size ) {
+	for ( i=0; i < new_len; i += size ) {
 		/* Step 1 - get the delta value and compute next index */
 		if ( bufferstep ) {
 			delta = inputbuffer & 0xf;