From 06a07e245c54e4ae6f337c43f70d288b3c346081 Mon Sep 17 00:00:00 2001
From: Monty <xiphmont@xiph.org>
Date: Thu, 25 Mar 2010 06:52:55 +0000
Subject: [PATCH] Fix leak when aborting out of static_codebook unpack.  Closes
 #1663.

svn path=/trunk/vorbis/; revision=17030
---
 lib/codebook.c   | 12 ++++++------
 lib/codebook.h   |  3 +--
 lib/info.c       |  2 +-
 lib/sharedbook.c | 10 ++--------
 4 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/lib/codebook.c b/lib/codebook.c
index 296bffa..6be63dc 100644
--- a/lib/codebook.c
+++ b/lib/codebook.c
@@ -146,9 +146,9 @@ int vorbis_staticbook_pack(const static_codebook *c,oggpack_buffer *opb){
 
 /* unpacks a codebook from the packet buffer into the codebook struct,
    readies the codebook auxiliary structures for decode *************/
-int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
+static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
   long i,j;
-  memset(s,0,sizeof(*s));
+  static_codebook *s=_ogg_calloc(1,sizeof(*s));
   s->allocedp=1;
 
   /* make sure alignment is correct */
@@ -207,7 +207,7 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
     break;
   default:
     /* EOF */
-    return(-1);
+    goto _eofout;
   }
 
   /* Do we have a mapping to unpack? */
@@ -249,12 +249,12 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
   }
 
   /* all set */
-  return(0);
+  return(s);
 
  _errout:
  _eofout:
-  vorbis_staticbook_clear(s);
-  return(-1);
+  vorbis_staticbook_destroy(s);
+  return(NULL);
 }
 
 /* returns the number of bits ************************************************/
diff --git a/lib/codebook.h b/lib/codebook.h
index 1723c8b..efaa1b0 100644
--- a/lib/codebook.h
+++ b/lib/codebook.h
@@ -79,7 +79,6 @@ typedef struct codebook{
   int           delta;
 } codebook;
 
-extern void vorbis_staticbook_clear(static_codebook *b);
 extern void vorbis_staticbook_destroy(static_codebook *b);
 extern int vorbis_book_init_encode(codebook *dest,const static_codebook *source);
 extern int vorbis_book_init_decode(codebook *dest,const static_codebook *source);
@@ -100,7 +99,7 @@ extern long vorbis_book_codelen(codebook *book,int entry);
 
 
 extern int vorbis_staticbook_pack(const static_codebook *c,oggpack_buffer *b);
-extern int vorbis_staticbook_unpack(oggpack_buffer *b,static_codebook *c);
+extern static_codebook *vorbis_staticbook_unpack(oggpack_buffer *b);
 
 extern int vorbis_book_encode(codebook *book, int a, oggpack_buffer *b);
 
diff --git a/lib/info.c b/lib/info.c
index 1f0b7e9..145da0e 100644
--- a/lib/info.c
+++ b/lib/info.c
@@ -279,7 +279,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){
   if(ci->books<=0)goto err_out;
   for(i=0;i<ci->books;i++){
     ci->book_param[i]=_ogg_calloc(1,sizeof(*ci->book_param[i]));
-    if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out;
+    if(!ci->book_param[i])goto err_out;
   }
 
   /* time backend settings; hooks are unused */
diff --git a/lib/sharedbook.c b/lib/sharedbook.c
index f0c788a..028da15 100644
--- a/lib/sharedbook.c
+++ b/lib/sharedbook.c
@@ -258,19 +258,13 @@ float *_book_unquantize(const static_codebook *b,int n,int *sparsemap){
   return(NULL);
 }
 
-void vorbis_staticbook_clear(static_codebook *b){
+void vorbis_staticbook_destroy(static_codebook *b){
   if(b->allocedp){
     if(b->quantlist)_ogg_free(b->quantlist);
     if(b->lengthlist)_ogg_free(b->lengthlist);
     memset(b,0,sizeof(*b));
-  }
-}
-
-void vorbis_staticbook_destroy(static_codebook *b){
-  if(b->allocedp){
-    vorbis_staticbook_clear(b);
     _ogg_free(b);
-  }
+  } /* otherwise, it is in static memory */
 }
 
 void vorbis_book_clear(codebook *b){
-- 
2.7.4