comparison ifo_read.c @ 91:23d412d59d62 src

Abort when PTT search table has zero entries The static analyzer from LLVM/Clang 1:3.4~svn194079-1 reports a possible allocation of size 0 in `libdvdread/src/ifo_read.c`. $ scan-build -o scan-build make $ scan-view scan-build/2013-11-18-155601-16168-1 When `vts_ptt_srpt->nr_of_srpts` is zero the allocation size is zero. vts_ptt_srpt->title = malloc(vts_ptt_srpt->nr_of_srpts * sizeof(ttu_t)); The manual of the function `malloc` writes the following. If size is 0, then malloc() returns either NULL, or a unique pointer value that can later be successfully passed to free(). So check for 0 and, if it is, abort by going to the label `fail`. Patch by Paul Menzel <paulepanter AT users DOT sourceforge DOT net>

90:9f5802d2767a

  if(vts_ptt_srpt->nr_of_srpts > info_length / sizeof(*data)) {
    fprintf(stderr, "libdvdread: PTT search table too small.\n");
    goto fail;
  }
  for(i = 0; i < vts_ptt_srpt->nr_of_srpts; i++) {
    /* Transformers 3 has PTT start bytes that point outside the SRPT PTT */
    uint32_t start = data[i];
    B2N_32(start);
    if(start + sizeof(ptt_info_t) > vts_ptt_srpt->last_byte + 1) {

91:23d412d59d62

  if(vts_ptt_srpt->nr_of_srpts > info_length / sizeof(*data)) {
    fprintf(stderr, "libdvdread: PTT search table too small.\n");
    goto fail;
  }

  if(vts_ptt_srpt->nr_of_srpts == 0) {
    fprintf(stderr, "libdvdread: Zero entries in PTT search table.\n");
    goto fail;
  }

  for(i = 0; i < vts_ptt_srpt->nr_of_srpts; i++) {
    /* Transformers 3 has PTT start bytes that point outside the SRPT PTT */
    uint32_t start = data[i];
    B2N_32(start);
    if(start + sizeof(ptt_info_t) > vts_ptt_srpt->last_byte + 1) {