summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--oss-fuzz/fuzzer_metadata.cc29
-rw-r--r--oss-fuzz/fuzzer_seek.cc14
-rw-r--r--src/libFLAC/metadata_object.c8
-rw-r--r--src/libFLAC/stream_decoder.c2
4 files changed, 36 insertions, 17 deletions
diff --git a/oss-fuzz/fuzzer_metadata.cc b/oss-fuzz/fuzzer_metadata.cc
index 7d3cb5ea..66f3d4cf 100644
--- a/oss-fuzz/fuzzer_metadata.cc
+++ b/oss-fuzz/fuzzer_metadata.cc
@@ -61,7 +61,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
command_length = data[0] >> 4;
- if(data[1] < 128) /* Use MSB as on/off */
+ if(0)//data[1] < 128) /* Use MSB as on/off */
alloc_check_threshold = data[1];
else
alloc_check_threshold = INT32_MAX;
@@ -218,22 +218,37 @@ static void run_tests_with_level_2_interface(char filename[], bool ogg, bool use
case 5:
if(metadata_block_transfer != 0 && metadata_block_transfer->is_valid()) {
metadata_block_put = FLAC::Metadata::clone(metadata_block_transfer);
- if(!iterator.insert_block_before(metadata_block_put))
- delete metadata_block_put;
+ if(metadata_block_put != 0 && metadata_block_put->is_valid()) {
+ if(!iterator.insert_block_before(metadata_block_put))
+ delete metadata_block_put;
+ }
+ else
+ if(metadata_block_put != 0)
+ delete metadata_block_put;
}
break;
case 6:
if(metadata_block_transfer != 0 && metadata_block_transfer->is_valid()) {
metadata_block_put = FLAC::Metadata::clone(metadata_block_transfer);
- if(!iterator.insert_block_after(metadata_block_put))
- delete metadata_block_put;
+ if(metadata_block_put != 0 && metadata_block_put->is_valid()) {
+ if(!iterator.insert_block_after(metadata_block_put))
+ delete metadata_block_put;
+ }
+ else
+ if(metadata_block_put != 0)
+ delete metadata_block_put;
}
break;
case 7:
if(metadata_block_transfer != 0 && metadata_block_transfer->is_valid()) {
metadata_block_put = FLAC::Metadata::clone(metadata_block_transfer);
- if(!iterator.set_block(metadata_block_put))
- delete metadata_block_put;
+ if(metadata_block_put != 0 && metadata_block_put->is_valid()) {
+ if(!iterator.set_block(metadata_block_put))
+ delete metadata_block_put;
+ }
+ else
+ if(metadata_block_put != 0)
+ delete metadata_block_put;
}
break;
case 8: /* Examine block */
diff --git a/oss-fuzz/fuzzer_seek.cc b/oss-fuzz/fuzzer_seek.cc
index ed89b233..a926f68f 100644
--- a/oss-fuzz/fuzzer_seek.cc
+++ b/oss-fuzz/fuzzer_seek.cc
@@ -47,11 +47,11 @@ int write_abort_check_counter = -1;
static FLAC__StreamDecoderWriteStatus write_callback(const FLAC__StreamDecoder *decoder, const FLAC__Frame *frame, const FLAC__int32 *const buffer[], void *client_data)
{
(void)decoder, (void)frame, (void)buffer, (void)client_data;
- if(write_abort_check_counter > 0)
+ if(write_abort_check_counter > 0) {
write_abort_check_counter--;
if(write_abort_check_counter == 0)
return FLAC__STREAM_DECODER_WRITE_STATUS_ABORT;
- else if(write_abort_check_counter == 0)
+ } else if(write_abort_check_counter == 0)
/* This must not happen: write callback called after abort is returned */
abort();
return FLAC__STREAM_DECODER_WRITE_STATUS_CONTINUE;
@@ -70,11 +70,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
uint8_t command_length;
FLAC__bool init_bools[16], ogg;
- if(size > 2 && data[1] < 128) /* Use MSB as on/off */
- alloc_check_threshold = data[1];
- else
- alloc_check_threshold = INT32_MAX;
- alloc_check_counter = 0;
+ if(size > 2 && data[1] < 128) /* Use MSB as on/off */
+ alloc_check_threshold = data[1];
+ else
+ alloc_check_threshold = INT32_MAX;
+ alloc_check_counter = 0;
write_abort_check_counter = -1;
diff --git a/src/libFLAC/metadata_object.c b/src/libFLAC/metadata_object.c
index d6ac3fc5..c1e54ab2 100644
--- a/src/libFLAC/metadata_object.c
+++ b/src/libFLAC/metadata_object.c
@@ -1183,8 +1183,10 @@ FLAC_API FLAC__bool FLAC__metadata_object_vorbiscomment_resize_comments(FLAC__St
return false;
for (uint32_t i = 0; i < new_num_comments; i++) {
object->data.vorbis_comment.comments[i].length = 0;
- if ((object->data.vorbis_comment.comments[i].entry = safe_malloc_(1)) == NULL)
+ if ((object->data.vorbis_comment.comments[i].entry = safe_malloc_(1)) == NULL) {
+ object->data.vorbis_comment.num_comments = i+1;
return false;
+ }
object->data.vorbis_comment.comments[i].entry[0] = '\0';
}
}
@@ -1223,8 +1225,10 @@ FLAC_API FLAC__bool FLAC__metadata_object_vorbiscomment_resize_comments(FLAC__St
if (new_size > old_size) {
for (uint32_t i = object->data.vorbis_comment.num_comments; i < new_num_comments; i++) {
object->data.vorbis_comment.comments[i].length = 0;
- if ((object->data.vorbis_comment.comments[i].entry = safe_malloc_(1)) == NULL)
+ if ((object->data.vorbis_comment.comments[i].entry = safe_malloc_(1)) == NULL) {
+ object->data.vorbis_comment.num_comments = i+1;
return false;
+ }
object->data.vorbis_comment.comments[i].entry[0] = '\0';
}
}
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
index 23a0c890..c8e3f325 100644
--- a/src/libFLAC/stream_decoder.c
+++ b/src/libFLAC/stream_decoder.c
@@ -1525,7 +1525,7 @@ FLAC__bool read_metadata_(FLAC__StreamDecoder *decoder)
free(block.data.vorbis_comment.comments);
break;
case FLAC__METADATA_TYPE_CUESHEET:
- if(block.data.cue_sheet.num_tracks > 0)
+ if(block.data.cue_sheet.num_tracks > 0 && 0 != block.data.cue_sheet.tracks)
for(i = 0; i < block.data.cue_sheet.num_tracks; i++)
if(0 != block.data.cue_sheet.tracks[i].indices)
free(block.data.cue_sheet.tracks[i].indices);