Description
In lib/speexdsp/libspeexdsp/mdf.c, the function speex_echo_state_init_mc allocates memory for the SpeexEchoState structure and checks if it returns NULL. However, it subsequently performs numerous allocations for internal buffers (e.g., st->e, st->x, st->input, etc.) without checking if any of these allocations succeed.
If any of these internal allocations fail (which is possible in constrained embedded environments), the function proceeds to use the pointers, leading to potential null pointer dereferences or undefined behavior later in the execution.
Location
lib/speexdsp/libspeexdsp/mdf.c: speex_echo_state_init_mc function (lines 416-536).
Impact
In low-memory conditions, a failed allocation will go unnoticed until the application attempts to access the invalid memory, causing a crash. A proper initialization routine should check all allocations and clean up/return an error if any fail.
Code Snippet
/* ... */
st->e = (spx_word16_t*)speex_alloc(C*N*sizeof(spx_word16_t));
st->x = (spx_word16_t*)speex_alloc(K*N*sizeof(spx_word16_t));
st->input = (spx_word16_t*)speex_alloc(C*st->frame_size*sizeof(spx_word16_t));
st->y = (spx_word16_t*)speex_alloc(C*N*sizeof(spx_word16_t));
/* ... no checks for NULL before use ... */
Description
In
lib/speexdsp/libspeexdsp/mdf.c, the function speex_echo_state_init_mc allocates memory for theSpeexEchoStatestructure and checks if it returnsNULL. However, it subsequently performs numerous allocations for internal buffers (e.g.,st->e,st->x,st->input, etc.) without checking if any of these allocations succeed.If any of these internal allocations fail (which is possible in constrained embedded environments), the function proceeds to use the pointers, leading to potential null pointer dereferences or undefined behavior later in the execution.
Location
lib/speexdsp/libspeexdsp/mdf.c: speex_echo_state_init_mc function (lines 416-536).Impact
In low-memory conditions, a failed allocation will go unnoticed until the application attempts to access the invalid memory, causing a crash. A proper initialization routine should check all allocations and clean up/return an error if any fail.
Code Snippet