|
1 --- a/Modules/audioop.c 2011-09-25 05:24:35.789815000 +0100 |
|
2 +++ b/Modules/audioop.c 2011-09-25 06:55:35.782359000 +0100 |
|
3 @@ -829,7 +829,7 @@ |
|
4 audioop_tostereo(PyObject *self, PyObject *args) |
|
5 { |
|
6 signed char *cp, *ncp; |
|
7 - int len, new_len, size, val1, val2, val = 0; |
|
8 + int len, size, val1, val2, val = 0; |
|
9 double fac1, fac2, fval, maxval; |
|
10 PyObject *rv; |
|
11 int i; |
|
12 @@ -846,14 +846,13 @@ |
|
13 return 0; |
|
14 } |
|
15 |
|
16 - new_len = len*2; |
|
17 - if (new_len < 0) { |
|
18 + if (len > INT_MAX/2) { |
|
19 PyErr_SetString(PyExc_MemoryError, |
|
20 "not enough memory for output buffer"); |
|
21 return 0; |
|
22 } |
|
23 |
|
24 - rv = PyString_FromStringAndSize(NULL, new_len); |
|
25 + rv = PyString_FromStringAndSize(NULL, len*2); |
|
26 if ( rv == 0 ) |
|
27 return 0; |
|
28 ncp = (signed char *)PyString_AsString(rv); |
|
29 @@ -1016,7 +1015,7 @@ |
|
30 { |
|
31 signed char *cp; |
|
32 unsigned char *ncp; |
|
33 - int len, new_len, size, size2, val = 0; |
|
34 + int len, size, size2, val = 0; |
|
35 PyObject *rv; |
|
36 int i, j; |
|
37 |
|
38 @@ -1030,13 +1029,12 @@ |
|
39 return 0; |
|
40 } |
|
41 |
|
42 - new_len = (len/size)*size2; |
|
43 - if (new_len < 0) { |
|
44 + if (len/size > INT_MAX/size2) { |
|
45 PyErr_SetString(PyExc_MemoryError, |
|
46 "not enough memory for output buffer"); |
|
47 return 0; |
|
48 } |
|
49 - rv = PyString_FromStringAndSize(NULL, new_len); |
|
50 + rv = PyString_FromStringAndSize(NULL, (len/size)*size2); |
|
51 if ( rv == 0 ) |
|
52 return 0; |
|
53 ncp = (unsigned char *)PyString_AsString(rv); |
|
54 @@ -1072,7 +1070,6 @@ |
|
55 int chan, d, *prev_i, *cur_i, cur_o; |
|
56 PyObject *state, *samps, *str, *rv = NULL; |
|
57 int bytes_per_frame; |
|
58 - size_t alloc_size; |
|
59 |
|
60 weightA = 1; |
|
61 weightB = 0; |
|
62 @@ -1115,14 +1112,13 @@ |
|
63 inrate /= d; |
|
64 outrate /= d; |
|
65 |
|
66 - alloc_size = sizeof(int) * (unsigned)nchannels; |
|
67 - if (alloc_size < nchannels) { |
|
68 + if ((size_t)nchannels > PY_SIZE_MAX/sizeof(int)) { |
|
69 PyErr_SetString(PyExc_MemoryError, |
|
70 "not enough memory for output buffer"); |
|
71 return 0; |
|
72 } |
|
73 - prev_i = (int *) malloc(alloc_size); |
|
74 - cur_i = (int *) malloc(alloc_size); |
|
75 + prev_i = (int *) malloc(nchannels * sizeof(int)); |
|
76 + cur_i = (int *) malloc(nchannels * sizeof(int)); |
|
77 if (prev_i == NULL || cur_i == NULL) { |
|
78 (void) PyErr_NoMemory(); |
|
79 goto exit; |
|
80 @@ -1160,24 +1156,11 @@ |
|
81 requires bytes_per_frame bytes. Computing this |
|
82 without spurious overflow is the challenge; we can |
|
83 settle for a reasonable upper bound, though. */ |
|
84 - int ceiling; /* the number of output frames */ |
|
85 - int nbytes; /* the number of output bytes needed */ |
|
86 - int q = len / inrate; |
|
87 - /* Now len = q * inrate + r exactly (with r = len % inrate), |
|
88 - and this is less than q * inrate + inrate = (q+1)*inrate. |
|
89 - So a reasonable upper bound on len*outrate/inrate is |
|
90 - ((q+1)*inrate)*outrate/inrate = |
|
91 - (q+1)*outrate. |
|
92 - */ |
|
93 - ceiling = (q+1) * outrate; |
|
94 - nbytes = ceiling * bytes_per_frame; |
|
95 - /* See whether anything overflowed; if not, get the space. */ |
|
96 - if (q+1 < 0 || |
|
97 - ceiling / outrate != q+1 || |
|
98 - nbytes / bytes_per_frame != ceiling) |
|
99 + int q = len > 0 ? 1 + (len - 1) / inrate : 0; |
|
100 + if (outrate > INT_MAX / q / bytes_per_frame) |
|
101 str = NULL; |
|
102 else |
|
103 - str = PyString_FromStringAndSize(NULL, nbytes); |
|
104 + str = PyString_FromStringAndSize(NULL, q * outrate * bytes_per_frame); |
|
105 |
|
106 if (str == NULL) { |
|
107 PyErr_SetString(PyExc_MemoryError, |
|
108 @@ -1296,7 +1279,7 @@ |
|
109 unsigned char *cp; |
|
110 unsigned char cval; |
|
111 signed char *ncp; |
|
112 - int len, new_len, size, val; |
|
113 + int len, size, val; |
|
114 PyObject *rv; |
|
115 int i; |
|
116 |
|
117 @@ -1309,18 +1292,17 @@ |
|
118 return 0; |
|
119 } |
|
120 |
|
121 - new_len = len*size; |
|
122 - if (new_len < 0) { |
|
123 + if (len > INT_MAX/size) { |
|
124 PyErr_SetString(PyExc_MemoryError, |
|
125 "not enough memory for output buffer"); |
|
126 return 0; |
|
127 } |
|
128 - rv = PyString_FromStringAndSize(NULL, new_len); |
|
129 + rv = PyString_FromStringAndSize(NULL, len*size); |
|
130 if ( rv == 0 ) |
|
131 return 0; |
|
132 ncp = (signed char *)PyString_AsString(rv); |
|
133 |
|
134 - for ( i=0; i < new_len; i += size ) { |
|
135 + for ( i=0; i < len*size; i += size ) { |
|
136 cval = *cp++; |
|
137 val = st_ulaw2linear16(cval); |
|
138 |
|
139 @@ -1370,7 +1352,7 @@ |
|
140 unsigned char *cp; |
|
141 unsigned char cval; |
|
142 signed char *ncp; |
|
143 - int len, new_len, size, val; |
|
144 + int len, size, val; |
|
145 PyObject *rv; |
|
146 int i; |
|
147 |
|
148 @@ -1383,18 +1365,17 @@ |
|
149 return 0; |
|
150 } |
|
151 |
|
152 - new_len = len*size; |
|
153 - if (new_len < 0) { |
|
154 + if (len > INT_MAX/size) { |
|
155 PyErr_SetString(PyExc_MemoryError, |
|
156 "not enough memory for output buffer"); |
|
157 return 0; |
|
158 } |
|
159 - rv = PyString_FromStringAndSize(NULL, new_len); |
|
160 + rv = PyString_FromStringAndSize(NULL, len*size); |
|
161 if ( rv == 0 ) |
|
162 return 0; |
|
163 ncp = (signed char *)PyString_AsString(rv); |
|
164 |
|
165 - for ( i=0; i < new_len; i += size ) { |
|
166 + for ( i=0; i < len*size; i += size ) { |
|
167 cval = *cp++; |
|
168 val = st_alaw2linear16(cval); |
|
169 |
|
170 @@ -1519,7 +1500,7 @@ |
|
171 { |
|
172 signed char *cp; |
|
173 signed char *ncp; |
|
174 - int len, new_len, size, valpred, step, delta, index, sign, vpdiff; |
|
175 + int len, size, valpred, step, delta, index, sign, vpdiff; |
|
176 PyObject *rv, *str, *state; |
|
177 int i, inputbuffer = 0, bufferstep; |
|
178 |
|
179 @@ -1541,13 +1522,12 @@ |
|
180 } else if ( !PyArg_ParseTuple(state, "ii", &valpred, &index) ) |
|
181 return 0; |
|
182 |
|
183 - new_len = len*size*2; |
|
184 - if (new_len < 0) { |
|
185 + if (len > (INT_MAX/2)/size) { |
|
186 PyErr_SetString(PyExc_MemoryError, |
|
187 "not enough memory for output buffer"); |
|
188 return 0; |
|
189 } |
|
190 - str = PyString_FromStringAndSize(NULL, new_len); |
|
191 + str = PyString_FromStringAndSize(NULL, len*size*2); |
|
192 if ( str == 0 ) |
|
193 return 0; |
|
194 ncp = (signed char *)PyString_AsString(str); |
|
195 @@ -1555,7 +1535,7 @@ |
|
196 step = stepsizeTable[index]; |
|
197 bufferstep = 0; |
|
198 |
|
199 - for ( i=0; i < new_len; i += size ) { |
|
200 + for ( i=0; i < len*size*2; i += size ) { |
|
201 /* Step 1 - get the delta value and compute next index */ |
|
202 if ( bufferstep ) { |
|
203 delta = inputbuffer & 0xf; |