@@ -824,7 +824,7 @@ static PyObject *
824
824
audioop_tostereo (PyObject * self , PyObject * args )
825
825
{
826
826
signed char * cp , * ncp ;
827
- int len , new_len , size , val1 , val2 , val = 0 ;
827
+ int len , size , val1 , val2 , val = 0 ;
828
828
double fac1 , fac2 , fval , maxval ;
829
829
PyObject * rv ;
830
830
int i ;
@@ -841,14 +841,13 @@ audioop_tostereo(PyObject *self, PyObject *args)
841
841
return 0 ;
842
842
}
843
843
844
- new_len = len * 2 ;
845
- if (new_len < 0 ) {
844
+ if (len > INT_MAX /2 ) {
846
845
PyErr_SetString (PyExc_MemoryError ,
847
846
"not enough memory for output buffer" );
848
847
return 0 ;
849
848
}
850
849
851
- rv = PyString_FromStringAndSize (NULL , new_len );
850
+ rv = PyString_FromStringAndSize (NULL , len * 2 );
852
851
if ( rv == 0 )
853
852
return 0 ;
854
853
ncp = (signed char * )PyString_AsString (rv );
@@ -1011,7 +1010,7 @@ audioop_lin2lin(PyObject *self, PyObject *args)
1011
1010
{
1012
1011
signed char * cp ;
1013
1012
unsigned char * ncp ;
1014
- int len , new_len , size , size2 , val = 0 ;
1013
+ int len , size , size2 , val = 0 ;
1015
1014
PyObject * rv ;
1016
1015
int i , j ;
1017
1016
@@ -1025,13 +1024,12 @@ audioop_lin2lin(PyObject *self, PyObject *args)
1025
1024
return 0 ;
1026
1025
}
1027
1026
1028
- new_len = (len /size )* size2 ;
1029
- if (new_len < 0 ) {
1027
+ if (len /size > INT_MAX /size2 ) {
1030
1028
PyErr_SetString (PyExc_MemoryError ,
1031
1029
"not enough memory for output buffer" );
1032
1030
return 0 ;
1033
1031
}
1034
- rv = PyString_FromStringAndSize (NULL , new_len );
1032
+ rv = PyString_FromStringAndSize (NULL , ( len / size ) * size2 );
1035
1033
if ( rv == 0 )
1036
1034
return 0 ;
1037
1035
ncp = (unsigned char * )PyString_AsString (rv );
@@ -1067,7 +1065,6 @@ audioop_ratecv(PyObject *self, PyObject *args)
1067
1065
int chan , d , * prev_i , * cur_i , cur_o ;
1068
1066
PyObject * state , * samps , * str , * rv = NULL ;
1069
1067
int bytes_per_frame ;
1070
- size_t alloc_size ;
1071
1068
1072
1069
weightA = 1 ;
1073
1070
weightB = 0 ;
@@ -1110,14 +1107,13 @@ audioop_ratecv(PyObject *self, PyObject *args)
1110
1107
inrate /= d ;
1111
1108
outrate /= d ;
1112
1109
1113
- alloc_size = sizeof (int ) * (unsigned )nchannels ;
1114
- if (alloc_size < nchannels ) {
1110
+ if ((size_t )nchannels > PY_SIZE_MAX /sizeof (int )) {
1115
1111
PyErr_SetString (PyExc_MemoryError ,
1116
1112
"not enough memory for output buffer" );
1117
1113
return 0 ;
1118
1114
}
1119
- prev_i = (int * ) malloc (alloc_size );
1120
- cur_i = (int * ) malloc (alloc_size );
1115
+ prev_i = (int * ) malloc (nchannels * sizeof ( int ) );
1116
+ cur_i = (int * ) malloc (nchannels * sizeof ( int ) );
1121
1117
if (prev_i == NULL || cur_i == NULL ) {
1122
1118
(void ) PyErr_NoMemory ();
1123
1119
goto exit ;
@@ -1291,7 +1287,7 @@ audioop_ulaw2lin(PyObject *self, PyObject *args)
1291
1287
unsigned char * cp ;
1292
1288
unsigned char cval ;
1293
1289
signed char * ncp ;
1294
- int len , new_len , size , val ;
1290
+ int len , size , val ;
1295
1291
PyObject * rv ;
1296
1292
int i ;
1297
1293
@@ -1304,18 +1300,17 @@ audioop_ulaw2lin(PyObject *self, PyObject *args)
1304
1300
return 0 ;
1305
1301
}
1306
1302
1307
- new_len = len * size ;
1308
- if (new_len < 0 ) {
1303
+ if (len > INT_MAX /size ) {
1309
1304
PyErr_SetString (PyExc_MemoryError ,
1310
1305
"not enough memory for output buffer" );
1311
1306
return 0 ;
1312
1307
}
1313
- rv = PyString_FromStringAndSize (NULL , new_len );
1308
+ rv = PyString_FromStringAndSize (NULL , len * size );
1314
1309
if ( rv == 0 )
1315
1310
return 0 ;
1316
1311
ncp = (signed char * )PyString_AsString (rv );
1317
1312
1318
- for ( i = 0 ; i < new_len ; i += size ) {
1313
+ for ( i = 0 ; i < len * size ; i += size ) {
1319
1314
cval = * cp ++ ;
1320
1315
val = st_ulaw2linear16 (cval );
1321
1316
@@ -1365,7 +1360,7 @@ audioop_alaw2lin(PyObject *self, PyObject *args)
1365
1360
unsigned char * cp ;
1366
1361
unsigned char cval ;
1367
1362
signed char * ncp ;
1368
- int len , new_len , size , val ;
1363
+ int len , size , val ;
1369
1364
PyObject * rv ;
1370
1365
int i ;
1371
1366
@@ -1378,18 +1373,17 @@ audioop_alaw2lin(PyObject *self, PyObject *args)
1378
1373
return 0 ;
1379
1374
}
1380
1375
1381
- new_len = len * size ;
1382
- if (new_len < 0 ) {
1376
+ if (len > INT_MAX /size ) {
1383
1377
PyErr_SetString (PyExc_MemoryError ,
1384
1378
"not enough memory for output buffer" );
1385
1379
return 0 ;
1386
1380
}
1387
- rv = PyString_FromStringAndSize (NULL , new_len );
1381
+ rv = PyString_FromStringAndSize (NULL , len * size );
1388
1382
if ( rv == 0 )
1389
1383
return 0 ;
1390
1384
ncp = (signed char * )PyString_AsString (rv );
1391
1385
1392
- for ( i = 0 ; i < new_len ; i += size ) {
1386
+ for ( i = 0 ; i < len * size ; i += size ) {
1393
1387
cval = * cp ++ ;
1394
1388
val = st_alaw2linear16 (cval );
1395
1389
@@ -1514,7 +1508,7 @@ audioop_adpcm2lin(PyObject *self, PyObject *args)
1514
1508
{
1515
1509
signed char * cp ;
1516
1510
signed char * ncp ;
1517
- int len , new_len , size , valpred , step , delta , index , sign , vpdiff ;
1511
+ int len , size , valpred , step , delta , index , sign , vpdiff ;
1518
1512
PyObject * rv , * str , * state ;
1519
1513
int i , inputbuffer = 0 , bufferstep ;
1520
1514
@@ -1536,21 +1530,20 @@ audioop_adpcm2lin(PyObject *self, PyObject *args)
1536
1530
} else if ( !PyArg_ParseTuple (state , "ii" , & valpred , & index ) )
1537
1531
return 0 ;
1538
1532
1539
- new_len = len * size * 2 ;
1540
- if (new_len < 0 ) {
1533
+ if (len > (INT_MAX /2 )/size ) {
1541
1534
PyErr_SetString (PyExc_MemoryError ,
1542
1535
"not enough memory for output buffer" );
1543
1536
return 0 ;
1544
1537
}
1545
- str = PyString_FromStringAndSize (NULL , new_len );
1538
+ str = PyString_FromStringAndSize (NULL , len * size * 2 );
1546
1539
if ( str == 0 )
1547
1540
return 0 ;
1548
1541
ncp = (signed char * )PyString_AsString (str );
1549
1542
1550
1543
step = stepsizeTable [index ];
1551
1544
bufferstep = 0 ;
1552
1545
1553
- for ( i = 0 ; i < new_len ; i += size ) {
1546
+ for ( i = 0 ; i < len * size * 2 ; i += size ) {
1554
1547
/* Step 1 - get the delta value and compute next index */
1555
1548
if ( bufferstep ) {
1556
1549
delta = inputbuffer & 0xf ;
0 commit comments