Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

STB Vorbis: Coverity static-analysis scan fixes #854

Merged
merged 2 commits into from
Feb 2, 2020
Merged

STB Vorbis: Coverity static-analysis scan fixes #854

merged 2 commits into from
Feb 2, 2020

Conversation

kcgen
Copy link
Contributor

@kcgen kcgen commented Dec 5, 2019

This PR consists of fixes for confirmed bugs in a Coverity Scan of the latest stb_vorbis version.

Commit 59e93f5 fixes #839.

Commit 0cbb6ee fixes #842.

In the call to decode_residue:
  decode_residue(f, residue_buffers, ch, n2, r, do_not_decode);

The channel count is previously intialized as zero and incremented
based on a for-loop (f->channels) plus a conditional,
if (map->chan[j].mux == i).  If this doesn't happen then 'ch'
remains zero.

Once inside decode_residue(..), the code has three branches based
on channel count: stereo (ch == 2), mono (ch == 1), and then the
exception if it's neither of those (simple 'else').  It's in here
where a zero-valued 'ch' can be used as the denominator in these
calculations:
    int c_inter = z % ch
    p_inter = z/ch;

Obviously this 'else' branch is meant for channel counts greater
than two an not for zero channels; so this change simply makes
that branch only valid if (ch > 2).
The eliminated code removes the (ch == 1) branch, which is scoped
within this if condition: `if (rtype == 2 && ch != 1)`, therefore
the (ch == 1) branch will never be taken.

Fixes #842.
@kcgen
Copy link
Contributor Author

kcgen commented Feb 2, 2020

Thanks @nothings !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants