b=987679 update speex resampler to speexdsp d60e75b2 r=padenot

--HG--
extra : rebase_source : 8837b12e4e70daf5c089978079eeb5fa7bd278a4

media/libspeex_resampler/README_MOZILLA

@@ -1,5 +1,5 @@
 This source is from the Speex DSP library
-(http://git.xiph.org/?p=speexdsp.git), from commit 769dc295.
+(http://git.xiph.org/?p=speexdsp.git), from commit d60e75b2.
 
 It consists in the audio resampling code (resampler.c) and its header files
 dependancies, imported into the tree using the update.sh script.

media/libspeex_resampler/hugemem.patch

@@ -20,7 +20,7 @@ diff --git a/media/libspeex_resampler/src/resample.c b/media/libspeex_resampler/
  #include "speex_resampler.h"
  #include "arch.h"
  #else /* OUTSIDE_SPEEX */
-@@ -632,18 +634,18 @@ static int update_filter(SpeexResamplerS
+@@ -633,24 +635,23 @@ static int update_filter(SpeexResamplerS
        if (st->oversample < 1)
           st->oversample = 1;
     } else {
@@ -31,13 +31,22 @@ diff --git a/media/libspeex_resampler/src/resample.c b/media/libspeex_resampler/
     /* Choose the resampling type that requires the least amount of memory */
 -#ifdef RESAMPLE_FULL_SINC_TABLE
 -   use_direct = 1;
+-   if (INT_MAX/sizeof(spx_word16_t)/st->den_rate < st->filt_len)
+-      goto fail;
++   use_direct =
 +#ifdef RESAMPLE_HUGEMEM
-+   use_direct = st->den_rate <= 16*(st->oversample+8);
++     st->den_rate <= 16*(st->oversample+8)
  #else
-    use_direct = st->filt_len*st->den_rate <= st->filt_len*st->oversample+8;
- #endif
+-   use_direct = st->filt_len*st->den_rate <= st->filt_len*st->oversample+8
++     st->filt_len*st->den_rate <= st->filt_len*st->oversample+8
++#endif
+                 && INT_MAX/sizeof(spx_word16_t)/st->den_rate >= st->filt_len;
+-#endif
     if (use_direct)
     {
        min_sinc_table_length = st->filt_len*st->den_rate;
     } else {
+       if ((INT_MAX/sizeof(spx_word16_t)-8)/st->oversample < st->filt_len)
+          goto fail;
+ 
        min_sinc_table_length = st->filt_len*st->oversample+8;

media/libspeex_resampler/src/resample.c

@@ -79,6 +79,7 @@ static void speex_free (void *ptr) {free(ptr);}
 
 #include "stack_alloc.h"
 #include <math.h>
+#include <limits.h>
 
 #ifndef M_PI
 #define M_PI 3.14159265358979323846
@@ -639,15 +640,20 @@ static int update_filter(SpeexResamplerState *st)
    }
    
    /* Choose the resampling type that requires the least amount of memory */
+   use_direct =
 #ifdef RESAMPLE_HUGEMEM
-   use_direct = st->den_rate <= 16*(st->oversample+8);
+     st->den_rate <= 16*(st->oversample+8)
 #else
-   use_direct = st->filt_len*st->den_rate <= st->filt_len*st->oversample+8;
+     st->filt_len*st->den_rate <= st->filt_len*st->oversample+8
 #endif
+                && INT_MAX/sizeof(spx_word16_t)/st->den_rate >= st->filt_len;
    if (use_direct)
    {
       min_sinc_table_length = st->filt_len*st->den_rate;
    } else {
+      if ((INT_MAX/sizeof(spx_word16_t)-8)/st->oversample < st->filt_len)
+         goto fail;
+
       min_sinc_table_length = st->filt_len*st->oversample+8;
    }
    if (st->sinc_table_length < min_sinc_table_length)
@@ -694,16 +700,20 @@ static int update_filter(SpeexResamplerState *st)
       /*fprintf (stderr, "resampler uses interpolated sinc table and normalised cutoff %f\n", cutoff);*/
    }
 
-   
    /* Here's the place where we update the filter memory to take into account
       the change in filter length. It's probably the messiest part of the code
       due to handling of lots of corner cases. */
+
+   /* Adding buffer_size to filt_len won't overflow here because filt_len
+      could be multiplied by sizeof(spx_word16_t) above. */
    min_alloc_size = st->filt_len-1 + st->buffer_size;
    if (min_alloc_size > st->mem_alloc_size)
    {
-      spx_word16_t *mem = (spx_word16_t*)speex_realloc(st->mem, st->nb_channels*min_alloc_size * sizeof(spx_word16_t));
-      if (!mem)
-         goto fail;
+      spx_word16_t *mem;
+      if (INT_MAX/sizeof(spx_word16_t)/st->nb_channels < min_alloc_size)
+          goto fail;
+      else if (!(mem = (spx_word16_t*)speex_realloc(st->mem, st->nb_channels*min_alloc_size * sizeof(*mem))))
+          goto fail;
 
       st->mem = mem;
       st->mem_alloc_size = min_alloc_size;