Bug Summary

File:root/firefox-clang/media/libvorbis/lib/vorbis_codebook.c
Warning:line 222, column 7
The first element of the 2nd argument is undefined
Note:line 222, column 7
Other elements might also be undefined

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name vorbis_codebook.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libvorbis -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libvorbis -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG=1 -D MOZ_HAS_MOZGLUE -I /root/firefox-clang/media/libvorbis -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libvorbis -I /root/firefox-clang/media/libvorbis/lib -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -Wno-uninitialized -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/media/libvorbis/lib/vorbis_codebook.c
1/********************************************************************
2 * *
3 * THIS FILE IS PART OF THE OggVorbis SOFTWARE CODEC SOURCE CODE. *
4 * USE, DISTRIBUTION AND REPRODUCTION OF THIS LIBRARY SOURCE IS *
5 * GOVERNED BY A BSD-STYLE SOURCE LICENSE INCLUDED WITH THIS SOURCE *
6 * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING. *
7 * *
8 * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2015 *
9 * by the Xiph.Org Foundation https://xiph.org/ *
10 * *
11 ********************************************************************
12
13 function: basic codebook pack/unpack/code/decode operations
14
15 ********************************************************************/
16
17#include <stdlib.h>
18#include <string.h>
19#include <math.h>
20#include <ogg/ogg.h>
21#include "vorbis/codec.h"
22#include "codebook.h"
23#include "scales.h"
24#include "misc.h"
25#include "os.h"
26
27/* packs the given codebook into the bitstream **************************/
28
29int vorbis_staticbook_pack(const static_codebook *c,oggpack_buffer *opb){
30 long i,j;
31 int ordered=0;
32
33 /* first the basic parameters */
34 oggpack_write(opb,0x564342,24);
35 oggpack_write(opb,c->dim,16);
36 oggpack_write(opb,c->entries,24);
37
38 /* pack the codewords. There are two packings; length ordered and
39 length random. Decide between the two now. */
40
41 for(i=1;i<c->entries;i++)
42 if(c->lengthlist[i-1]==0 || c->lengthlist[i]<c->lengthlist[i-1])break;
43 if(i==c->entries)ordered=1;
44
45 if(ordered){
46 /* length ordered. We only need to say how many codewords of
47 each length. The actual codewords are generated
48 deterministically */
49
50 long count=0;
51 oggpack_write(opb,1,1); /* ordered */
52 oggpack_write(opb,c->lengthlist[0]-1,5); /* 1 to 32 */
53
54 for(i=1;i<c->entries;i++){
55 char this=c->lengthlist[i];
56 char last=c->lengthlist[i-1];
57 if(this>last){
58 for(j=last;j<this;j++){
59 oggpack_write(opb,i-count,ov_ilog(c->entries-count));
60 count=i;
61 }
62 }
63 }
64 oggpack_write(opb,i-count,ov_ilog(c->entries-count));
65
66 }else{
67 /* length random. Again, we don't code the codeword itself, just
68 the length. This time, though, we have to encode each length */
69 oggpack_write(opb,0,1); /* unordered */
70
71 /* algortihmic mapping has use for 'unused entries', which we tag
72 here. The algorithmic mapping happens as usual, but the unused
73 entry has no codeword. */
74 for(i=0;i<c->entries;i++)
75 if(c->lengthlist[i]==0)break;
76
77 if(i==c->entries){
78 oggpack_write(opb,0,1); /* no unused entries */
79 for(i=0;i<c->entries;i++)
80 oggpack_write(opb,c->lengthlist[i]-1,5);
81 }else{
82 oggpack_write(opb,1,1); /* we have unused entries; thus we tag */
83 for(i=0;i<c->entries;i++){
84 if(c->lengthlist[i]==0){
85 oggpack_write(opb,0,1);
86 }else{
87 oggpack_write(opb,1,1);
88 oggpack_write(opb,c->lengthlist[i]-1,5);
89 }
90 }
91 }
92 }
93
94 /* is the entry number the desired return value, or do we have a
95 mapping? If we have a mapping, what type? */
96 oggpack_write(opb,c->maptype,4);
97 switch(c->maptype){
98 case 0:
99 /* no mapping */
100 break;
101 case 1:case 2:
102 /* implicitly populated value mapping */
103 /* explicitly populated value mapping */
104
105 if(!c->quantlist){
106 /* no quantlist? error */
107 return(-1);
108 }
109
110 /* values that define the dequantization */
111 oggpack_write(opb,c->q_min,32);
112 oggpack_write(opb,c->q_delta,32);
113 oggpack_write(opb,c->q_quant-1,4);
114 oggpack_write(opb,c->q_sequencep,1);
115
116 {
117 int quantvals;
118 switch(c->maptype){
119 case 1:
120 /* a single column of (c->entries/c->dim) quantized values for
121 building a full value list algorithmically (square lattice) */
122 quantvals=_book_maptype1_quantvals(c->dim, c->entries);
123 break;
124 case 2:
125 /* every value (c->entries*c->dim total) specified explicitly */
126 quantvals=c->entries*c->dim;
127 break;
128 default: /* NOT_REACHABLE */
129 quantvals=-1;
130 }
131
132 /* quantized values */
133 for(i=0;i<quantvals;i++)
134 oggpack_write(opb,labs(c->quantlist[i]),c->q_quant);
135
136 }
137 break;
138 default:
139 /* error case; we don't have any other map types now */
140 return(-1);
141 }
142
143 return(0);
144}
145
146/* unpacks a codebook from the packet buffer into the codebook struct */
147int vorbis_decbook_unpack(dec_codebook *c,oggpack_buffer *opb){
148 long i;
149
150 /* make sure alignment is correct */
151 if(oggpack_read(opb,24)!=0x564342)goto _eofout;
1
Assuming the condition is false
→
2
←
Taking false branch
→
152
153 /* first the basic parameters */
154 c->dim=(signed char)oggpack_read(opb,16);
155 c->entries=(ogg_int32_t)oggpack_read(opb,24);
156 if(c->entries==-1)goto _eofout;
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
157
158 if(ov_ilog(c->dim)+ov_ilog(c->entries)>24)goto _eofout;
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
159
160 /* codeword ordering.... length ordered or unordered? */
161 switch((int)oggpack_read(opb,1)){
7
←
Control jumps to 'case 1:' at line 195
→
162 case 0:{
163 long unused;
164 /* allocated but unused entries? */
165 unused=oggpack_read(opb,1);
166 if((c->entries*(unused?1:5)+7)>>3>opb->storage-oggpack_bytes(opb))
167 goto _eofout;
168 /* unordered */
169 c->codelengths=_ogg_mallocogg_malloc_func(sizeof(*c->codelengths)*c->entries);
170 if(c->codelengths==NULL((void*)0))goto _errout;
171
172 /* allocated but unused entries? */
173 if(unused){
174 /* yes, unused entries */
175
176 for(i=0;i<c->entries;i++){
177 if(oggpack_read(opb,1)){
178 long num=oggpack_read(opb,5);
179 if(num==-1)goto _eofout;
180 c->codelengths[i]=(signed char)(num+1);
181 }else
182 c->codelengths[i]=0;
183 }
184 }else{
185 /* all entries used; no tagging */
186 for(i=0;i<c->entries;i++){
187 long num=oggpack_read(opb,5);
188 if(num==-1)goto _eofout;
189 c->codelengths[i]=(signed char)(num+1);
190 }
191 }
192
193 break;
194 }
195 case 1:
196 /* ordered */
197 {
198 ogg_int32_t cum_entries[32];
8
←
'cum_entries' declared without an initial value
→
199 long minlength=oggpack_read(opb,5)+1;
200 long maxlength;
201 long length;
202 if(minlength==0)goto _eofout;
9
←
Assuming 'minlength' is not equal to 0
→
10
←
Taking false branch
→
203 maxlength=length=minlength;
204 for(i=0;i<c->entries;length++){
11
←
Assuming 'i' is >= field 'entries'
→
12
←
Loop condition is false. Execution continues on line 218
→
205 long num=oggpack_read(opb,ov_ilog(c->entries-i));
206 if(num==-1)goto _eofout;
207 if(length>32 || num>c->entries-i ||
208 (num>0 && (num-1)>>(length-1)>1)){
209 goto _errout;
210 }
211 i+=num;
212 cum_entries[length-minlength]=(ogg_int32_t)i;
213 /* skip lengths with 0 entries at the start, to avoid creating a
214 malformed codeword sentinel in vorbis_book_init_decode(). */
215 if(i==0)minlength++;
216 maxlength=length;
217 }
218 c->minlength=(signed char)minlength;
219 c->maxlength=(signed char)maxlength;
220 c->index=_ogg_mallocogg_malloc_func((maxlength-minlength+1)*sizeof(*c->index));
221 if(c->index==NULL((void*)0))goto _errout;
13
←
Assuming field 'index' is not equal to NULL
→
14
←
Taking false branch
→
222 memcpy(c->index,cum_entries,(maxlength-minlength+1)*sizeof(*c->index));
Other elements might also be undefined
15
←
The first element of the 2nd argument is undefined
223 }
224 break;
225 default:
226 /* EOF */
227 goto _eofout;
228 }
229
230 /* Do we have a mapping to unpack? */
231 switch((c->maptype=(signed char)oggpack_read(opb,4))){
232 case 0:
233 /* no mapping */
234 break;
235 case 1: case 2:
236 /* implicitly populated value mapping */
237 /* explicitly populated value mapping */
238
239 c->q_min=(ogg_uint32_t)oggpack_read(opb,32);
240 c->q_delta=(ogg_uint32_t)oggpack_read(opb,32);
241 c->q_quant=(signed char)oggpack_read(opb,4)+1;
242 c->q_sequencep=(signed char)oggpack_read(opb,1);
243 if(c->q_sequencep==-1)goto _eofout;
244
245 {
246 long q=0;
247 int quantvals=0;
248 switch(c->maptype){
249 case 1:
250 quantvals=(c->dim==0?0:_book_maptype1_quantvals(c->dim, c->entries));
251 break;
252 case 2:
253 quantvals=c->entries*c->dim;
254 break;
255 }
256
257 /* quantized values */
258 if(((quantvals*c->q_quant+7)>>3)>opb->storage-oggpack_bytes(opb))
259 goto _eofout;
260 c->quantlist=_ogg_mallocogg_malloc_func(sizeof(*c->quantlist)*quantvals);
261 if(c->quantlist==NULL((void*)0))goto _errout;
262 for(i=0;i<quantvals;i++){
263 q=oggpack_read(opb,c->q_quant);
264 c->quantlist[i]=(ogg_uint16_t)q;
265 }
266
267 if(q==-1)goto _eofout;
268 }
269 break;
270 default:
271 goto _errout;
272 }
273
274 /* all set */
275 /* we could finish initializing the decode tables here, but this was a
276 separate step back when we had a shared encoder/decoder codebook struct,
277 and deferring it ensures we continue to report the same kinds of errors
278 in the same places. */
279 return(0);
280
281 _errout:
282 _eofout:
283 /* our caller will clean up the partially constructed book */
284 return(-1);
285}
286
287/* returns the number of bits ************************************************/
288int vorbis_book_encode(codebook *book, int a, oggpack_buffer *b){
289 if(a<0 || a>=book->c->entries)return(0);
290 oggpack_write(b,book->codelist[a],book->c->lengthlist[a]);
291 return(book->c->lengthlist[a]);
292}
293
294/* the 'eliminate the decode tree' optimization actually requires the
295 codewords to be MSb first, not LSb. This is an annoying inelegancy
296 (and one of the first places where carefully thought out design
297 turned out to be wrong; Vorbis II and future Ogg codecs should go
298 to an MSb bitpacker), but not actually the huge hit it appears to
299 be. The first-stage decode table catches most words so that
300 bitreverse is not in the main execution path. */
301
302static ogg_uint32_t bitreverse(ogg_uint32_t x){
303 x= ((x>>16)&0x0000ffff) | ((x<<16)&0xffff0000);
304 x= ((x>> 8)&0x00ff00ff) | ((x<< 8)&0xff00ff00);
305 x= ((x>> 4)&0x0f0f0f0f) | ((x<< 4)&0xf0f0f0f0);
306 x= ((x>> 2)&0x33333333) | ((x<< 2)&0xcccccccc);
307 return((x>> 1)&0x55555555) | ((x<< 1)&0xaaaaaaaa);
308}
309
310STINstatic __inline__ long decode_packed_entry_number(dec_codebook *book, oggpack_buffer *b){
311 ogg_uint32_t testword;
312 int read=book->maxlength;
313 long lo,hi;
314 long lok = oggpack_look(b,book->firsttablen);
315
316 if (lok >= 0) {
317 long entry = book->firsttable[lok];
318 if(entry&0x80000000UL){
319 lo=((entry>>15)&0x7fff)<<book->hint_shift;
320 hi=book->hi_max-((entry&0x7fff)<<book->hint_shift);
321 }else{
322 oggpack_adv(b, (int)(entry&0x3f));
323 return(entry>>6);
324 }
325 }else{
326 lo=0;
327 hi=book->hi_max;
328 }
329
330 /* Single entry codebooks use a firsttablen of 1 and a
331 dec_maxlength of 1. If a single-entry codebook gets here (due to
332 failure to read one bit above), the next look attempt will also
333 fail and we'll correctly kick out instead of trying to walk the
334 underformed tree */
335
336 lok = oggpack_look(b, read);
337
338 while(lok<0 && read>1)
339 lok = oggpack_look(b, --read);
340 if(lok<0)return -1;
341
342 testword=bitreverse((ogg_uint32_t)lok);
343 if(book->codelengths==NULL((void*)0)){
344 int length;
345 /* ordered codebook: search for the codeword length */
346 while(testword>book->codelist[lo])lo++;
347 length=(int)lo+book->minlength;
348 if(length<=read){
349 long entry=
350 book->index[lo]-(((book->codelist[lo]-testword)>>(32-length))+1);
351 oggpack_adv(b, length);
352 return(entry);
353 }
354 }else{
355 /* bisect search for the codeword in the ordered list */
356 while(hi-lo>1){
357 long p=(hi-lo)>>1;
358 long test=book->codelist[lo+p]>testword;
359 lo+=p&(test-1);
360 hi-=p&(-test);
361 }
362
363 if(book->codelengths[lo]<=read){
364 oggpack_adv(b, book->codelengths[lo]);
365 return(lo);
366 }
367 }
368
369 oggpack_adv(b, read);
370
371 return(-1);
372}
373
374/* Decode side is specced and easier, because we don't need to find
375 matches using different criteria; we simply read and map. There are
376 two things we need to do 'depending':
377
378 We may need to support interleave. We don't really, but it's
379 convenient to do it here rather than rebuild the vector later.
380
381 Cascades may be additive or multiplicitive; this is not inherent in
382 the codebook, but set in the code using the codebook. Like
383 interleaving, it's easiest to do it here.
384 addmul==0 -> declarative (set the value)
385 addmul==1 -> additive
386 addmul==2 -> multiplicitive */
387
388/* returns the [original, not compacted] entry number or -1 on eof *********/
389long vorbis_book_decode(dec_codebook *book, oggpack_buffer *b){
390 if(book->codelist){
391 long packed_entry=decode_packed_entry_number(book,b);
392 if(packed_entry>=0){
393 /* if we have an unordered book, look up the original entry number */
394 if(book->codelengths)
395 return(book->index[packed_entry]);
396 /* if we have an ordered book, the packed_entry number is the original */
397 return(packed_entry);
398 }
399 }
400
401 /* if there's no codelist, the codebook hasn't been init'd */
402 return(-1);
403}
404
405/* returns 0 on OK or -1 on eof *************************************/
406/* decode vector / dim granularity gaurding is done in the upper layer */
407long vorbis_book_decodevs_add(dec_codebook *book,float *a,oggpack_buffer *b,
408 int n){
409 if(book->codelist){
410 int step=n/book->dim;
411 long *entry = alloca(sizeof(*entry)*step)__builtin_alloca (sizeof(*entry)*step);
412 float **t = alloca(sizeof(*t)*step)__builtin_alloca (sizeof(*t)*step);
413 int i,j,o;
414
415 for (i = 0; i < step; i++) {
416 entry[i]=decode_packed_entry_number(book,b);
417 if(entry[i]==-1)return(-1);
418 t[i] = book->valuelist+entry[i]*book->dim;
419 }
420 for(i=0,o=0;i<book->dim;i++,o+=step)
421 for (j=0;o+j<n && j<step;j++)
422 a[o+j]+=t[j][i];
423 }
424 return(0);
425}
426
427/* decode vector / dim granularity gaurding is done in the upper layer */
428long vorbis_book_decodev_add(dec_codebook *book,float *a,oggpack_buffer *b,
429 int n){
430 if(book->codelist){
431 int i,j,entry;
432 float *t;
433
434 for(i=0;i<n;){
435 entry = decode_packed_entry_number(book,b);
436 if(entry==-1)return(-1);
437 t = book->valuelist+entry*book->dim;
438 for(j=0;i<n && j<book->dim;)
439 a[i++]+=t[j++];
440 }
441 }
442 return(0);
443}
444
445/* unlike the others, we guard against n not being an integer number
446 of <dim> internally rather than in the upper layer (called only by
447 floor0) */
448long vorbis_book_decodev_set(dec_codebook *book,float *a,oggpack_buffer *b,
449 int n){
450 if(book->codelist){
451 int i,j,entry;
452 float *t;
453
454 for(i=0;i<n;){
455 entry = decode_packed_entry_number(book,b);
456 if(entry==-1)return(-1);
457 t = book->valuelist+entry*book->dim;
458 for (j=0;i<n && j<book->dim;){
459 a[i++]=t[j++];
460 }
461 }
462 }else{
463 int i;
464
465 for(i=0;i<n;){
466 a[i++]=0.f;
467 }
468 }
469 return(0);
470}
471
472long vorbis_book_decodevv_add(dec_codebook *book,float **a,long offset,int ch,
473 oggpack_buffer *b,int n){
474
475 long i,j,entry;
476 int chptr=0;
477 if(book->codelist){
478 int m=(offset+n)/ch;
479 for(i=offset/ch;i<m;){
480 entry = decode_packed_entry_number(book,b);
481 if(entry==-1)return(-1);
482 {
483 const float *t = book->valuelist+entry*book->dim;
484 for (j=0;i<m && j<book->dim;j++){
485 a[chptr++][i]+=t[j];
486 if(chptr==ch){
487 chptr=0;
488 i++;
489 }
490 }
491 }
492 }
493 }
494 return(0);
495}