diff -urN libvorbis-1.3.4-orig/lib/block.c libvorbis-1.3.4/lib/block.c
--- libvorbis-1.3.4-orig/lib/block.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/block.c	2014-02-06 03:54:11 +0900
@@ -94,6 +94,8 @@
   if(v->analysisp){
     vorbis_block_internal *vbi=
       vb->internal=_ogg_calloc(1,sizeof(vorbis_block_internal));
+    if(!vbi)
+     return(-1);
     vbi->ampmax=-9999;
 
     for(i=0;i<PACKETBLOBS;i++){
@@ -102,6 +104,15 @@
       }else{
         vbi->packetblob[i]=
           _ogg_calloc(1,sizeof(oggpack_buffer));
+        if(!vbi->packetblob[i]){
+         for(;i>=0;i--){
+          if(i!=PACKETBLOBS/2)
+           _ogg_free(vbi->packetblob[i]);
+         }
+         _ogg_free(vbi);
+         vb->internal=NULL;
+         return(-1);
+        }
       }
       oggpack_writeinit(vbi->packetblob[i]);
     }
@@ -116,6 +127,7 @@
     /* can't just _ogg_realloc... there are outstanding pointers */
     if(vb->localstore){
       struct alloc_chain *link=_ogg_malloc(sizeof(*link));
+      if(!link) return NULL;
       vb->totaluse+=vb->localtop;
       link->next=vb->reap;
       link->ptr=vb->localstore;
@@ -125,6 +137,10 @@
     vb->localalloc=bytes;
     vb->localstore=_ogg_malloc(vb->localalloc);
     vb->localtop=0;
+    if(!vb->localstore){
+      vb->localalloc=0;
+      return NULL;
+    }
   }
   {
     void *ret=(void *)(((char *)vb->localstore)+vb->localtop);
@@ -146,8 +162,11 @@
   }
   /* consolidate storage */
   if(vb->totaluse){
-    vb->localstore=_ogg_realloc(vb->localstore,vb->totaluse+vb->localalloc);
-    vb->localalloc+=vb->totaluse;
+    void*newstore=_ogg_realloc(vb->localstore,vb->totaluse+vb->localalloc);
+    if(newstore){
+      vb->localstore=newstore;
+      vb->localalloc+=vb->totaluse;
+    }
     vb->totaluse=0;
   }
 
@@ -189,19 +208,24 @@
 
   memset(v,0,sizeof(*v));
   b=v->backend_state=_ogg_calloc(1,sizeof(*b));
+  if(!b) return -1;
 
   v->vi=vi;
   b->modebits=ilog2(ci->modes);
 
   b->transform[0]=_ogg_calloc(VI_TRANSFORMB,sizeof(*b->transform[0]));
+  if(!b->transform[0]) goto abort_clear;
   b->transform[1]=_ogg_calloc(VI_TRANSFORMB,sizeof(*b->transform[1]));
+  if(!b->transform[1]) goto abort_clear;
 
   /* MDCT is tranform 0 */
 
   b->transform[0][0]=_ogg_calloc(1,sizeof(mdct_lookup));
+  if(!b->transform[0][0]) goto abort_clear;
   b->transform[1][0]=_ogg_calloc(1,sizeof(mdct_lookup));
-  mdct_init(b->transform[0][0],ci->blocksizes[0]>>hs);
-  mdct_init(b->transform[1][0],ci->blocksizes[1]>>hs);
+  if(!b->transform[1][0]) goto abort_clear;
+  if(mdct_init(b->transform[0][0],ci->blocksizes[0]>>hs)!=0) goto abort_clear;
+  if(mdct_init(b->transform[1][0],ci->blocksizes[1]>>hs)!=0) goto abort_clear;
 
   /* Vorbis I uses only window type 0 */
   b->window[0]=ilog2(ci->blocksizes[0])-6;
@@ -210,17 +234,20 @@
   if(encp){ /* encode/decode differ here */
 
     /* analysis always needs an fft */
-    drft_init(&b->fft_look[0],ci->blocksizes[0]);
-    drft_init(&b->fft_look[1],ci->blocksizes[1]);
+    if(drft_init(&b->fft_look[0],ci->blocksizes[0])!=0) goto abort_clear;
+    if(drft_init(&b->fft_look[1],ci->blocksizes[1])!=0) goto abort_clear;
 
     /* finish the codebooks */
     if(!ci->fullbooks){
       ci->fullbooks=_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
+      if(!ci->fullbooks) goto abort_clear;
       for(i=0;i<ci->books;i++)
-        vorbis_book_init_encode(ci->fullbooks+i,ci->book_param[i]);
+        if(vorbis_book_init_encode(ci->fullbooks+i,ci->book_param[i])!=0)
+          goto abort_clear;
     }
 
     b->psy=_ogg_calloc(ci->psys,sizeof(*b->psy));
+    if(!b->psy) goto abort_clear;
     for(i=0;i<ci->psys;i++){
       _vp_psy_init(b->psy+i,
                    ci->psy_param[i],
@@ -234,6 +261,7 @@
     /* finish the codebooks */
     if(!ci->fullbooks){
       ci->fullbooks=_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
+      if(!ci->fullbooks) goto abort_clear;
       for(i=0;i<ci->books;i++){
         if(ci->book_param[i]==NULL)
           goto abort_books;
@@ -250,12 +278,17 @@
      but the correct size for decode */
   v->pcm_storage=ci->blocksizes[1];
   v->pcm=_ogg_malloc(vi->channels*sizeof(*v->pcm));
-  v->pcmret=_ogg_malloc(vi->channels*sizeof(*v->pcmret));
+  if(!v->pcm) goto abort_clear;
   {
     int i;
     for(i=0;i<vi->channels;i++)
       v->pcm[i]=_ogg_calloc(v->pcm_storage,sizeof(*v->pcm[i]));
+    for(i=0;i<vi->channels;i++){
+      if(!v->pcm[i]) goto abort_clear;
+    }
   }
+  v->pcmret=_ogg_malloc(vi->channels*sizeof(*v->pcmret));
+  if(!v->pcmret) goto abort_clear;
 
   /* all 1 (large block) or 0 (small block) */
   /* explicitly set for the sake of clarity */
@@ -269,15 +302,22 @@
 
   /* initialize all the backend lookups */
   b->flr=_ogg_calloc(ci->floors,sizeof(*b->flr));
-  b->residue=_ogg_calloc(ci->residues,sizeof(*b->residue));
-
+  if(!b->flr) goto abort_clear;
   for(i=0;i<ci->floors;i++)
     b->flr[i]=_floor_P[ci->floor_type[i]]->
       look(v,ci->floor_param[i]);
+  for(i=0;i<ci->floors;i++){
+    if(!b->flr[i]) goto abort_clear;
+  }
 
+  b->residue=_ogg_calloc(ci->residues,sizeof(*b->residue));
+  if(!b->residue) goto abort_clear;
   for(i=0;i<ci->residues;i++)
     b->residue[i]=_residue_P[ci->residue_type[i]]->
       look(v,ci->residue_param[i]);
+  for(i=0;i<ci->residues;i++){
+    if(!b->residue[i]) goto abort_clear;
+  }
 
   return 0;
  abort_books:
@@ -287,6 +327,7 @@
       ci->book_param[i]=NULL;
     }
   }
+ abort_clear:
   vorbis_dsp_clear(v);
   return -1;
 }
diff -urN libvorbis-1.3.4-orig/lib/codebook.c libvorbis-1.3.4/lib/codebook.c
--- libvorbis-1.3.4-orig/lib/codebook.c	2014-01-22 21:32:53 +0900
+++ libvorbis-1.3.4/lib/codebook.c	2014-02-06 03:54:11 +0900
@@ -149,6 +149,7 @@
 static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
   long i,j;
   static_codebook *s=_ogg_calloc(1,sizeof(*s));
+  if(!s)goto _errout;
   s->allocedp=1;
 
   /* make sure alignment is correct */
@@ -171,6 +172,7 @@
       goto _eofout;
     /* unordered */
     s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
+    if(!s->lengthlist)goto _errout;
 
     /* allocated but unused entries? */
     if(unused){
@@ -201,6 +203,7 @@
       long length=oggpack_read(opb,5)+1;
       if(length==0)goto _eofout;
       s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
+      if(!s->lengthlist)goto _errout;
 
       for(i=0;i<s->entries;){
         long num=oggpack_read(opb,_ilog(s->entries-i));
@@ -251,6 +254,7 @@
       if(((quantvals*s->q_quant+7)>>3)>opb->storage-oggpack_bytes(opb))
         goto _eofout;
       s->quantlist=_ogg_malloc(sizeof(*s->quantlist)*quantvals);
+      if(!s->quantlist)goto _errout;
       for(i=0;i<quantvals;i++)
         s->quantlist[i]=oggpack_read(opb,s->q_quant);
 
@@ -266,7 +270,7 @@
 
  _errout:
  _eofout:
-  vorbis_staticbook_destroy(s);
+  if(s)vorbis_staticbook_destroy(s);
   return(NULL);
 }
 
diff -urN libvorbis-1.3.4-orig/lib/envelope.c libvorbis-1.3.4/lib/envelope.c
--- libvorbis-1.3.4-orig/lib/envelope.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/envelope.c	2014-02-06 03:54:11 +0900
@@ -29,7 +29,7 @@
 #include "mdct.h"
 #include "misc.h"
 
-void _ve_envelope_init(envelope_lookup *e,vorbis_info *vi){
+int _ve_envelope_init(envelope_lookup *e,vorbis_info *vi){
   codec_setup_info *ci=vi->codec_setup;
   vorbis_info_psy_global *gi=&ci->psy_g_param;
   int ch=vi->channels;
@@ -42,7 +42,8 @@
   e->storage=128;
   e->cursor=ci->blocksizes[1]/2;
   e->mdct_win=_ogg_calloc(n,sizeof(*e->mdct_win));
-  mdct_init(&e->mdct,n);
+  if(!e->mdct_win)goto err_out;
+  if(mdct_init(&e->mdct,n)!=0)goto err_out;
 
   for(i=0;i<n;i++){
     e->mdct_win[i]=sin(i/(n-1.)*M_PI);
@@ -61,6 +62,7 @@
   for(j=0;j<VE_BANDS;j++){
     n=e->band[j].end;
     e->band[j].window=_ogg_malloc(n*sizeof(*e->band[0].window));
+    if(!e->band[j].window)goto err_free;
     for(i=0;i<n;i++){
       e->band[j].window[i]=sin((i+.5)/n*M_PI);
       e->band[j].total+=e->band[j].window[i];
@@ -70,7 +72,14 @@
 
   e->filter=_ogg_calloc(VE_BANDS*ch,sizeof(*e->filter));
   e->mark=_ogg_calloc(e->storage,sizeof(*e->mark));
+  return(0);
 
+err_free:
+  for(j=0;j<VE_BANDS&&e->band[j].window;j++)
+    _ogg_free(e->band[j].window);
+err_out:
+  _ve_envelope_clear(e);
+  return(-1);
 }
 
 void _ve_envelope_clear(envelope_lookup *e){
diff -urN libvorbis-1.3.4-orig/lib/envelope.h libvorbis-1.3.4/lib/envelope.h
--- libvorbis-1.3.4-orig/lib/envelope.h	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/envelope.h	2014-02-06 03:54:11 +0900
@@ -70,7 +70,7 @@
   long cursor;
 } envelope_lookup;
 
-extern void _ve_envelope_init(envelope_lookup *e,vorbis_info *vi);
+extern int  _ve_envelope_init(envelope_lookup *e,vorbis_info *vi);
 extern void _ve_envelope_clear(envelope_lookup *e);
 extern long _ve_envelope_search(vorbis_dsp_state *v);
 extern void _ve_envelope_shift(envelope_lookup *e,long shift);
diff -urN libvorbis-1.3.4-orig/lib/floor0.c libvorbis-1.3.4/lib/floor0.c
--- libvorbis-1.3.4-orig/lib/floor0.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/floor0.c	2014-02-06 03:54:11 +0900
@@ -76,6 +76,7 @@
   int j;
 
   vorbis_info_floor0 *info=_ogg_malloc(sizeof(*info));
+  if(!info)goto err_out;
   info->order=oggpack_read(opb,8);
   info->rate=oggpack_read(opb,16);
   info->barkmap=oggpack_read(opb,16);
@@ -109,9 +110,9 @@
    Note that the scale depends on the sampling rate as well as the
    linear block and mapping sizes */
 
-static void floor0_map_lazy_init(vorbis_block      *vb,
-                                 vorbis_info_floor *infoX,
-                                 vorbis_look_floor0 *look){
+static int floor0_map_lazy_init(vorbis_block      *vb,
+                                vorbis_info_floor *infoX,
+                                vorbis_look_floor0 *look){
   if(!look->linearmap[vb->W]){
     vorbis_dsp_state   *vd=vb->vd;
     vorbis_info        *vi=vd->vi;
@@ -132,6 +133,7 @@
        necessary in some mapping combinations to keep the scale spacing
        accurate */
     look->linearmap[W]=_ogg_malloc((n+1)*sizeof(**look->linearmap));
+    if(!look->linearmap[W])return(0);
     for(j=0;j<n;j++){
       int val=floor( toBARK((info->rate/2.f)/n*j)
                      *scale); /* bark numbers represent band edges */
@@ -141,12 +143,14 @@
     look->linearmap[W][j]=-1;
     look->n[W]=n;
   }
+  return(1);
 }
 
 static vorbis_look_floor *floor0_look(vorbis_dsp_state *vd,
                                       vorbis_info_floor *i){
   vorbis_info_floor0 *info=(vorbis_info_floor0 *)i;
   vorbis_look_floor0 *look=_ogg_calloc(1,sizeof(*look));
+  if(!look)goto err_out;
 
   (void)vd;
 
@@ -155,8 +159,13 @@
   look->vi=info;
 
   look->linearmap=_ogg_calloc(2,sizeof(*look->linearmap));
+  if(!look->linearmap)goto err_out;
 
   return look;
+
+ err_out:
+  floor0_free_look(look);
+  return(NULL);
 }
 
 static void *floor0_inverse1(vorbis_block *vb,vorbis_look_floor *i){
@@ -199,7 +208,7 @@
   vorbis_look_floor0 *look=(vorbis_look_floor0 *)i;
   vorbis_info_floor0 *info=look->vi;
 
-  floor0_map_lazy_init(vb,info,look);
+  if(!floor0_map_lazy_init(vb,info,look))return(0);
 
   if(memo){
     float *lsp=(float *)memo;
diff -urN libvorbis-1.3.4-orig/lib/floor1.c libvorbis-1.3.4/lib/floor1.c
--- libvorbis-1.3.4-orig/lib/floor1.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/floor1.c	2014-02-06 03:54:11 +0900
@@ -136,6 +136,7 @@
   int j,k,count=0,maxclass=-1,rangebits;
 
   vorbis_info_floor1 *info=_ogg_calloc(1,sizeof(*info));
+  if(!info)goto err_out;
   /* read partitions */
   info->partitions=oggpack_read(opb,5); /* only 0 to 31 legal */
   for(j=0;j<info->partitions;j++){
@@ -201,6 +202,7 @@
   int *sortpointer[VIF_POSIT+2];
   vorbis_info_floor1 *info=(vorbis_info_floor1 *)in;
   vorbis_look_floor1 *look=_ogg_calloc(1,sizeof(*look));
+  if(!look)return(NULL);
   int i,j,n=0;
 
   (void)vd;
@@ -716,6 +718,7 @@
     }
 
     output=_vorbis_block_alloc(vb,sizeof(*output)*posts);
+    if(!output)return NULL;
 
     output[0]=post_Y(fit_valueA,fit_valueB,0);
     output[1]=post_Y(fit_valueA,fit_valueB,1);
@@ -756,6 +759,7 @@
 
   if(A && B){
     output=_vorbis_block_alloc(vb,sizeof(*output)*posts);
+    if(!output)return NULL;
 
     /* overly simpleminded--- look again post 1.2 */
     for(i=0;i<posts;i++){
@@ -979,6 +983,7 @@
   /* unpack wrapped/predicted values from stream */
   if(oggpack_read(&vb->opb,1)==1){
     int *fit_value=_vorbis_block_alloc(vb,(look->posts)*sizeof(*fit_value));
+    if(!fit_value)goto eop;
 
     fit_value[0]=oggpack_read(&vb->opb,ilog(look->quant_q-1));
     fit_value[1]=oggpack_read(&vb->opb,ilog(look->quant_q-1));
diff -urN libvorbis-1.3.4-orig/lib/info.c libvorbis-1.3.4/lib/info.c
--- libvorbis-1.3.4-orig/lib/info.c	2014-01-23 03:03:37 +0900
+++ libvorbis-1.3.4/lib/info.c	2014-02-06 03:54:11 +0900
@@ -63,12 +63,17 @@
 }
 
 void vorbis_comment_add(vorbis_comment *vc,const char *comment){
-  vc->user_comments=_ogg_realloc(vc->user_comments,
-                            (vc->comments+2)*sizeof(*vc->user_comments));
-  vc->comment_lengths=_ogg_realloc(vc->comment_lengths,
-                                  (vc->comments+2)*sizeof(*vc->comment_lengths));
+  char **user_comments=_ogg_realloc(vc->user_comments,
+                                   (vc->comments+2)*sizeof(*vc->user_comments));
+  if(!user_comments)return;
+  vc->user_comments=user_comments;
+  int *comment_lengths=_ogg_realloc(vc->comment_lengths,
+                                   (vc->comments+2)*sizeof(*vc->comment_lengths));
+  if(!comment_lengths)return;
+  vc->comment_lengths=comment_lengths;
   vc->comment_lengths[vc->comments]=strlen(comment);
   vc->user_comments[vc->comments]=_ogg_malloc(vc->comment_lengths[vc->comments]+1);
+  if(!vc->user_comments[vc->comments])return;
   strcpy(vc->user_comments[vc->comments], comment);
   vc->comments++;
   vc->user_comments[vc->comments]=NULL;
@@ -243,13 +248,16 @@
   if(vendorlen<0)goto err_out;
   if(vendorlen>opb->storage-8)goto err_out;
   vc->vendor=_ogg_calloc(vendorlen+1,1);
+  if(!vc->vendor)goto err_out;
   _v_readstring(opb,vc->vendor,vendorlen);
   i=oggpack_read(opb,32);
   if(i<0)goto err_out;
   if(i>((opb->storage-oggpack_bytes(opb))>>2))goto err_out;
   vc->comments=i;
   vc->user_comments=_ogg_calloc(vc->comments+1,sizeof(*vc->user_comments));
+  if(!vc->user_comments)goto err_out;
   vc->comment_lengths=_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
+  if(!vc->comment_lengths)goto err_out;
 
   for(i=0;i<vc->comments;i++){
     int len=oggpack_read(opb,32);
@@ -257,6 +265,7 @@
     if(len>opb->storage-oggpack_bytes(opb))goto err_out;
     vc->comment_lengths[i]=len;
     vc->user_comments[i]=_ogg_calloc(len+1,1);
+    if(!vc->user_comments[i])goto err_out;
     _v_readstring(opb,vc->user_comments[i],len);
   }
   if(oggpack_read(opb,1)!=1)goto err_out; /* EOP check */
@@ -327,6 +336,7 @@
   if(ci->modes<=0)goto err_out;
   for(i=0;i<ci->modes;i++){
     ci->mode_param[i]=_ogg_calloc(1,sizeof(*ci->mode_param[i]));
+    if(!ci->mode_param[i])goto err_out;
     ci->mode_param[i]->blockflag=oggpack_read(opb,1);
     ci->mode_param[i]->windowtype=oggpack_read(opb,16);
     ci->mode_param[i]->transformtype=oggpack_read(opb,16);
@@ -556,6 +566,7 @@
   }
 
   op->packet = _ogg_malloc(oggpack_bytes(&opb));
+  if(!op->packet)return 0;
   memcpy(op->packet, opb.buffer, oggpack_bytes(&opb));
 
   op->bytes=oggpack_bytes(&opb);
@@ -591,6 +602,7 @@
   /* build the packet */
   if(b->header)_ogg_free(b->header);
   b->header=_ogg_malloc(oggpack_bytes(&opb));
+  if(!b->header)goto err_out;
   memcpy(b->header,opb.buffer,oggpack_bytes(&opb));
   op->packet=b->header;
   op->bytes=oggpack_bytes(&opb);
@@ -606,6 +618,7 @@
 
   if(b->header1)_ogg_free(b->header1);
   b->header1=_ogg_malloc(oggpack_bytes(&opb));
+  if(!b->header1)goto err_out;
   memcpy(b->header1,opb.buffer,oggpack_bytes(&opb));
   op_comm->packet=b->header1;
   op_comm->bytes=oggpack_bytes(&opb);
@@ -621,6 +634,7 @@
 
   if(b->header2)_ogg_free(b->header2);
   b->header2=_ogg_malloc(oggpack_bytes(&opb));
+  if(!b->header2)goto err_out;
   memcpy(b->header2,opb.buffer,oggpack_bytes(&opb));
   op_code->packet=b->header2;
   op_code->bytes=oggpack_bytes(&opb);
diff -urN libvorbis-1.3.4-orig/lib/mapping0.c libvorbis-1.3.4/lib/mapping0.c
--- libvorbis-1.3.4-orig/lib/mapping0.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/mapping0.c	2014-02-06 03:54:11 +0900
@@ -103,6 +103,7 @@
   int i,b;
   vorbis_info_mapping0 *info=_ogg_calloc(1,sizeof(*info));
   codec_setup_info     *ci=vi->codec_setup;
+  if(!info)goto err_out;
   memset(info,0,sizeof(*info));
 
   b=oggpack_read(opb,1);
diff -urN libvorbis-1.3.4-orig/lib/mdct.c libvorbis-1.3.4/lib/mdct.c
--- libvorbis-1.3.4-orig/lib/mdct.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/mdct.c	2014-02-06 03:54:11 +0900
@@ -49,9 +49,14 @@
 /* build lookups for trig functions; also pre-figure scaling and
    some window function algebra. */
 
-void mdct_init(mdct_lookup *lookup,int n){
+int mdct_init(mdct_lookup *lookup,int n){
   int   *bitrev=_ogg_malloc(sizeof(*bitrev)*(n/4));
+  if(!bitrev)return(-1);
   DATA_TYPE *T=_ogg_malloc(sizeof(*T)*(n+n/4));
+  if(!T){
+    _ogg_free(bitrev);
+    return(-1);
+  }
 
   int i;
   int n2=n>>1;
@@ -88,6 +93,7 @@
     }
   }
   lookup->scale=FLOAT_CONV(4.f/n);
+  return(0);
 }
 
 /* 8 point butterfly (in place, 4 register) */
diff -urN libvorbis-1.3.4-orig/lib/mdct.h libvorbis-1.3.4/lib/mdct.h
--- libvorbis-1.3.4-orig/lib/mdct.h	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/mdct.h	2014-02-06 03:54:11 +0900
@@ -63,7 +63,7 @@
   DATA_TYPE scale;
 } mdct_lookup;
 
-extern void mdct_init(mdct_lookup *lookup,int n);
+extern int mdct_init(mdct_lookup *lookup,int n);
 extern void mdct_clear(mdct_lookup *l);
 extern void mdct_forward(mdct_lookup *init, DATA_TYPE *in, DATA_TYPE *out);
 extern void mdct_backward(mdct_lookup *init, DATA_TYPE *in, DATA_TYPE *out);
diff -urN libvorbis-1.3.4-orig/lib/psy.c libvorbis-1.3.4/lib/psy.c
--- libvorbis-1.3.4-orig/lib/psy.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/psy.c	2014-02-06 03:54:11 +0900
@@ -92,6 +92,7 @@
   float *brute_buffer=alloca(n*sizeof(*brute_buffer));
 
   float ***ret=_ogg_malloc(sizeof(*ret)*P_BANDS);
+  if(!ret)goto err_out;
 
   memset(workc,0,sizeof(workc));
 
@@ -159,6 +160,7 @@
   for(i=0;i<P_BANDS;i++){
     int hi_curve,lo_curve,bin;
     ret[i]=_ogg_malloc(sizeof(**ret)*P_LEVELS);
+    if(!ret[i])goto err_free;
 
     /* low frequency curves are measured with greater resolution than
        the MDCT/FFT will actually give us; we want the curve applied
@@ -179,6 +181,7 @@
 
     for(m=0;m<P_LEVELS;m++){
       ret[i][m]=_ogg_malloc(sizeof(***ret)*(EHMER_MAX+2));
+      if(!ret[i][m])goto err_free;
 
       for(j=0;j<n;j++)brute_buffer[j]=999.;
 
@@ -262,10 +265,20 @@
   }
 
   return(ret);
+
+err_free:
+  for(i=0;i<P_BANDS&&ret[i];i++){
+    for(m=0;m<P_LEVELS&&ret[i][m];m++){
+      _ogg_free(ret[i][m]);
+    }
+    _ogg_free(ret[i]);
+  }
+err_out:
+  return(NULL);
 }
 
-void _vp_psy_init(vorbis_look_psy *p,vorbis_info_psy *vi,
-                  vorbis_info_psy_global *gi,int n,long rate){
+int _vp_psy_init(vorbis_look_psy *p,vorbis_info_psy *vi,
+                 vorbis_info_psy_global *gi,int n,long rate){
   long i,j,lo=-99,hi=1;
   long maxoc;
   memset(p,0,sizeof(*p));
@@ -277,9 +290,12 @@
   maxoc=toOC((n+.25f)*rate*.5/n)*(1<<(p->shiftoc+1))+.5f;
   p->total_octave_lines=maxoc-p->firstoc+1;
   p->ath=_ogg_malloc(n*sizeof(*p->ath));
+  if(!p->ath)goto err_out;
 
   p->octave=_ogg_malloc(n*sizeof(*p->octave));
+  if(!p->octave)goto err_out;
   p->bark=_ogg_malloc(n*sizeof(*p->bark));
+  if(!p->bark)goto err_out;
   p->vi=vi;
   p->n=n;
   p->rate=rate;
@@ -326,11 +342,16 @@
 
   p->tonecurves=setup_tone_curves(vi->toneatt,rate*.5/n,n,
                                   vi->tone_centerboost,vi->tone_decay);
+  if(!p->tonecurves)goto err_out;
 
   /* set up rolling noise median */
   p->noiseoffset=_ogg_malloc(P_NOISECURVES*sizeof(*p->noiseoffset));
+  if(!p->noiseoffset)goto err_out;
   for(i=0;i<P_NOISECURVES;i++)
     p->noiseoffset[i]=_ogg_malloc(n*sizeof(**p->noiseoffset));
+  for(i=0;i<P_NOISECURVES;i++){
+    if(!p->noiseoffset[i])goto err_out;
+  }
 
   for(i=0;i<n;i++){
     float halfoc=toOC((i+.5)*rate/(2.*n))*2.;
@@ -356,6 +377,10 @@
     _analysis_output_always("noiseoff2",ls++,p->noiseoffset[2],n,1,0,0);
   }
 #endif
+  return(0);
+err_out:
+  _vp_psy_clear(p);
+  return(-1);
 }
 
 void _vp_psy_clear(vorbis_look_psy *p){
diff -urN libvorbis-1.3.4-orig/lib/psy.h libvorbis-1.3.4/lib/psy.h
--- libvorbis-1.3.4-orig/lib/psy.h	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/psy.h	2014-02-06 03:54:11 +0900
@@ -113,7 +113,7 @@
 
 } vorbis_look_psy;
 
-extern void   _vp_psy_init(vorbis_look_psy *p,vorbis_info_psy *vi,
+extern int    _vp_psy_init(vorbis_look_psy *p,vorbis_info_psy *vi,
                            vorbis_info_psy_global *gi,int n,long rate);
 extern void   _vp_psy_clear(vorbis_look_psy *p);
 extern void  *_vi_psy_dup(void *source);
diff -urN libvorbis-1.3.4-orig/lib/res0.c libvorbis-1.3.4/lib/res0.c
--- libvorbis-1.3.4-orig/lib/res0.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/res0.c	2014-02-06 03:54:24 +0900
@@ -140,12 +140,16 @@
     }
     fprintf(stderr,"\n");*/
 
-    for(j=0;j<look->parts;j++)
-      if(look->partbooks[j])_ogg_free(look->partbooks[j]);
-    _ogg_free(look->partbooks);
-    for(j=0;j<look->partvals;j++)
-      _ogg_free(look->decodemap[j]);
-    _ogg_free(look->decodemap);
+    if(look->partbooks){
+      for(j=0;j<look->parts;j++)
+        if(look->partbooks[j])_ogg_free(look->partbooks[j]);
+      _ogg_free(look->partbooks);
+    }
+    if(look->decodemap){
+      for(j=0;j<look->partvals;j++)
+        _ogg_free(look->decodemap[j]);
+      _ogg_free(look->decodemap);
+    }
 
     memset(look,0,sizeof(*look));
     _ogg_free(look);
@@ -205,6 +209,7 @@
   int j,acc=0;
   vorbis_info_residue0 *info=_ogg_calloc(1,sizeof(*info));
   codec_setup_info     *ci=vi->codec_setup;
+  if(!info)goto errout;
 
   info->begin=oggpack_read(opb,24);
   info->end=oggpack_read(opb,24);
@@ -270,6 +275,7 @@
   vorbis_info_residue0 *info=(vorbis_info_residue0 *)vr;
   vorbis_look_residue0 *look=_ogg_calloc(1,sizeof(*look));
   codec_setup_info     *ci=vd->vi->codec_setup;
+  if(!look)goto errout;
 
   int j,k,acc=0;
   int dim;
@@ -282,18 +288,21 @@
   dim=look->phrasebook->dim;
 
   look->partbooks=_ogg_calloc(look->parts,sizeof(*look->partbooks));
+  if(!look->partbooks)goto errout;
 
   for(j=0;j<look->parts;j++){
     int stages=ilog(info->secondstages[j]);
     if(stages){
       if(stages>maxstage)maxstage=stages;
       look->partbooks[j]=_ogg_calloc(stages,sizeof(*look->partbooks[j]));
+      if(!look->partbooks[j])goto errout;
       for(k=0;k<stages;k++)
         if(info->secondstages[j]&(1<<k)){
           look->partbooks[j][k]=ci->fullbooks+info->booklist[acc++];
 #ifdef TRAIN_RES
           look->training_data[k][j]=_ogg_calloc(look->partbooks[j][k]->entries,
                                            sizeof(***look->training_data));
+          if(!look->training_data[k][j])goto errout;
 #endif
         }
     }
@@ -304,11 +313,13 @@
       look->partvals*=look->parts;
 
   look->stages=maxstage;
-  look->decodemap=_ogg_malloc(look->partvals*sizeof(*look->decodemap));
+  look->decodemap=_ogg_calloc(look->partvals,sizeof(*look->decodemap));
+  if(!look->decodemap)goto errout;
   for(j=0;j<look->partvals;j++){
     long val=j;
     long mult=look->partvals/look->parts;
     look->decodemap[j]=_ogg_malloc(dim*sizeof(*look->decodemap[j]));
+    if(!look->decodemap[j])goto errout;
     for(k=0;k<dim;k++){
       long deco=val/mult;
       val-=deco*mult;
@@ -323,6 +334,10 @@
   }
 #endif
   return(look);
+
+ errout:
+  res0_free_look(look);
+  return(NULL);
 }
 
 /* break an abstraction and copy some code for performance purposes */
@@ -429,6 +444,7 @@
 
   int partvals=n/samples_per_partition;
   long **partword=_vorbis_block_alloc(vb,ch*sizeof(*partword));
+  if(!partword)return(NULL);
   float scale=100./samples_per_partition;
 
   /* we find the partition type for each partition of each
@@ -437,6 +453,7 @@
 
   for(i=0;i<ch;i++){
     partword[i]=_vorbis_block_alloc(vb,n/samples_per_partition*sizeof(*partword[i]));
+    if(!partword[i])return(NULL);
     memset(partword[i],0,n/samples_per_partition*sizeof(*partword[i]));
   }
 
@@ -674,8 +691,10 @@
     int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
     int ***partword=alloca(ch*sizeof(*partword));
 
-    for(j=0;j<ch;j++)
+    for(j=0;j<ch;j++){
       partword[j]=_vorbis_block_alloc(vb,partwords*sizeof(*partword[j]));
+      if(!partword[j])goto errout;
+    }
 
     for(s=0;s<look->stages;s++){
 
@@ -792,6 +811,7 @@
      reshape ourselves into a single channel res1 */
   /* ugly; reallocs for each coupling pass :-( */
   int *work=_vorbis_block_alloc(vb,ch*n*sizeof(*work));
+  if(!work)return(0);
   for(i=0;i<ch;i++){
     int *pcm=in[i];
     if(nonzero[i])used++;
@@ -829,6 +849,7 @@
     int partvals=n/samples_per_partition;
     int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
     int **partword=_vorbis_block_alloc(vb,partwords*sizeof(*partword));
+    if(!partword)goto errout;
 
     for(i=0;i<ch;i++)if(nonzero[i])break;
     if(i==ch)return(0); /* no nonzero vectors */
diff -urN libvorbis-1.3.4-orig/lib/sharedbook.c libvorbis-1.3.4/lib/sharedbook.c
--- libvorbis-1.3.4-orig/lib/sharedbook.c	2014-01-22 21:32:53 +0900
+++ libvorbis-1.3.4/lib/sharedbook.c	2014-02-06 03:54:11 +0900
@@ -74,6 +74,8 @@
   long i,j,count=0;
   ogg_uint32_t marker[33];
   ogg_uint32_t *r=_ogg_malloc((sparsecount?sparsecount:n)*sizeof(*r));
+  if(!r)
+    return(NULL);
   memset(marker,0,sizeof(marker));
 
   for(i=0;i<n;i++){
@@ -200,6 +202,7 @@
     float mindel=_float32_unpack(b->q_min);
     float delta=_float32_unpack(b->q_delta);
     float *r=_ogg_calloc(n*b->dim,sizeof(*r));
+    if(!r)return(NULL);
 
     /* maptype 1 and 2 both use a quantized value vector, but
        different sizes */
@@ -351,6 +354,10 @@
 
     sortindex=alloca(n*sizeof(*sortindex));
     c->codelist=_ogg_malloc(n*sizeof(*c->codelist));
+    if(c->codelist==NULL){
+      _ogg_free(codes);
+      goto err_out;
+    }
     /* the index is a reverse index */
     for(i=0;i<n;i++){
       int position=codep[i]-codes;
@@ -364,12 +371,14 @@
 
     c->valuelist=_book_unquantize(s,n,sortindex);
     c->dec_index=_ogg_malloc(n*sizeof(*c->dec_index));
+    if(c->dec_index==NULL)goto err_out;
 
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0)
         c->dec_index[sortindex[n++]]=i;
 
     c->dec_codelengths=_ogg_malloc(n*sizeof(*c->dec_codelengths));
+    if(c->dec_codelengths==NULL)goto err_out;
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0)
         c->dec_codelengths[sortindex[n++]]=s->lengthlist[i];
@@ -380,6 +389,7 @@
 
     tabn=1<<c->dec_firsttablen;
     c->dec_firsttable=_ogg_calloc(tabn,sizeof(*c->dec_firsttable));
+    if(c->dec_firsttable==NULL)goto err_out;
     c->dec_maxlength=0;
 
     for(i=0;i<n;i++){
diff -urN libvorbis-1.3.4-orig/lib/smallft.c libvorbis-1.3.4/lib/smallft.c
--- libvorbis-1.3.4-orig/lib/smallft.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/smallft.c	2014-02-06 03:54:11 +0900
@@ -1239,11 +1239,16 @@
   drftb1(l->n,data,l->trigcache,l->trigcache+l->n,l->splitcache);
 }
 
-void drft_init(drft_lookup *l,int n){
+int drft_init(drft_lookup *l,int n){
   l->n=n;
   l->trigcache=_ogg_calloc(3*n,sizeof(*l->trigcache));
   l->splitcache=_ogg_calloc(32,sizeof(*l->splitcache));
+  if(!l->trigcache||!l->splitcache){
+    drft_clear(l);
+    return(-1);
+  }
   fdrffti(n, l->trigcache, l->splitcache);
+  return(0);
 }
 
 void drft_clear(drft_lookup *l){
diff -urN libvorbis-1.3.4-orig/lib/smallft.h libvorbis-1.3.4/lib/smallft.h
--- libvorbis-1.3.4-orig/lib/smallft.h	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/smallft.h	2014-02-06 03:54:11 +0900
@@ -28,7 +28,7 @@
 
 extern void drft_forward(drft_lookup *l,float *data);
 extern void drft_backward(drft_lookup *l,float *data);
-extern void drft_init(drft_lookup *l,int n);
+extern int drft_init(drft_lookup *l,int n);
 extern void drft_clear(drft_lookup *l);
 
 #endif
diff -urN libvorbis-1.3.4-orig/lib/synthesis.c libvorbis-1.3.4/lib/synthesis.c
--- libvorbis-1.3.4-orig/lib/synthesis.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/synthesis.c	2014-02-06 03:54:11 +0900
@@ -79,8 +79,12 @@
   /* alloc pcm passback storage */
   vb->pcmend=ci->blocksizes[vb->W];
   vb->pcm=_vorbis_block_alloc(vb,sizeof(*vb->pcm)*vi->channels);
+  if(!vb->pcm) return(OV_EFAULT);
   for(i=0;i<vi->channels;i++)
     vb->pcm[i]=_vorbis_block_alloc(vb,vb->pcmend*sizeof(*vb->pcm[i]));
+  for(i=0;i<vi->channels;i++){
+    if(!vb->pcm[i]) return(OV_EFAULT);
+  }
 
   /* unpack_header enforces range checking */
   type=ci->map_type[ci->mode_param[mode]->mapping];
diff -urN libvorbis-1.3.4-orig/lib/vorbisfile.c libvorbis-1.3.4/lib/vorbisfile.c
--- libvorbis-1.3.4-orig/lib/vorbisfile.c	2014-01-22 18:53:32 +0900
+++ libvorbis-1.3.4/lib/vorbisfile.c	2014-02-06 03:54:11 +0900
@@ -69,6 +69,7 @@
   if(!(vf->callbacks.read_func))return(-1);
   if(vf->datasource){
     char *buffer=ogg_sync_buffer(&vf->oy,READSIZE);
+    if(!buffer)return(-1);
     long bytes=(vf->callbacks.read_func)(buffer,1,READSIZE,vf->datasource);
     if(bytes>0)ogg_sync_wrote(&vf->oy,bytes);
     if(bytes==0 && errno)return(-1);
@@ -190,10 +191,20 @@
   (*n)++;
 
   if(*serialno_list){
-    *serialno_list = _ogg_realloc(*serialno_list, sizeof(**serialno_list)*(*n));
+    long *new_list = _ogg_realloc(*serialno_list, sizeof(**serialno_list)*(*n));
+    if(!new_list){
+      _ogg_free(*serialno_list);
+      *serialno_list = NULL;
+    }else{
+      *serialno_list = new_list;
+    }
   }else{
     *serialno_list = _ogg_malloc(sizeof(**serialno_list));
   }
+  if(!*serialno_list){
+    (*n) = 0;
+    return;
+  }
 
   (*serialno_list)[(*n)-1] = s;
 }
@@ -312,6 +323,12 @@
       }
 
       _add_serialno(og_ptr,serialno_list,serialno_n);
+      if(!*serialno_list){
+        /* out of memory */
+        *serialno_n=0;
+        ret=OV_EBADHEADER;
+        goto bail_header;
+      }
     }
 
     if(vf->ready_state<STREAMSET){
@@ -495,6 +512,9 @@
        find the last vorbis page belonging to the first vorbis stream
        for this link. */
 
+    vorbis_info *vi;
+    vorbis_comment *vc;
+
     while(endserial != serialno){
       endserial = serialno;
       vf->offset=_get_prev_page_serial(vf,currentno_list,currentnos,&endserial,&endgran);
@@ -506,11 +526,17 @@
     if(vf->dataoffsets)_ogg_free(vf->dataoffsets);
 
     vf->offsets=_ogg_malloc((vf->links+1)*sizeof(*vf->offsets));
-    vf->vi=_ogg_realloc(vf->vi,vf->links*sizeof(*vf->vi));
-    vf->vc=_ogg_realloc(vf->vc,vf->links*sizeof(*vf->vc));
+    vi=_ogg_realloc(vf->vi,vf->links*sizeof(*vf->vi));
+    if(vi)vf->vi=vi;
+    vc=_ogg_realloc(vf->vc,vf->links*sizeof(*vf->vc));
+    if(vc)vf->vc=vc;
     vf->serialnos=_ogg_malloc(vf->links*sizeof(*vf->serialnos));
     vf->dataoffsets=_ogg_malloc(vf->links*sizeof(*vf->dataoffsets));
     vf->pcmlengths=_ogg_malloc(vf->links*2*sizeof(*vf->pcmlengths));
+    if(!vf->offsets||!vi||!vc||!vf->serialnos||!vf->dataoffsets||!vf->pcmlengths){
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
 
     vf->offsets[m+1]=end;
     vf->offsets[m]=begin;
@@ -907,6 +933,10 @@
   vf->links=1;
   vf->vi=_ogg_calloc(vf->links,sizeof(*vf->vi));
   vf->vc=_ogg_calloc(vf->links,sizeof(*vf->vc));
+  if(!vf->vi||!vf->vc){
+    ov_clear(vf);
+    return(OV_EFAULT);
+  }
   ogg_stream_init(&vf->os,-1); /* fill in the serialno later */
 
   /* Fetch all BOS pages, store the vorbis header and all seen serial
@@ -919,12 +949,22 @@
        for second stage of seekable stream open; this saves having to
        seek/reread first link's serialnumber data then. */
     vf->serialnos=_ogg_calloc(serialno_list_size+2,sizeof(*vf->serialnos));
+    if(!vf->serialnos){
+      if(serialno_list)_ogg_free(serialno_list);
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
     vf->serialnos[0]=vf->current_serialno=vf->os.serialno;
     vf->serialnos[1]=serialno_list_size;
     memcpy(vf->serialnos+2,serialno_list,serialno_list_size*sizeof(*vf->serialnos));
 
     vf->offsets=_ogg_calloc(1,sizeof(*vf->offsets));
     vf->dataoffsets=_ogg_calloc(1,sizeof(*vf->dataoffsets));
+    if(!vf->offsets||!vf->dataoffsets){
+      if(serialno_list)_ogg_free(serialno_list);
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
     vf->offsets[0]=0;
     vf->dataoffsets[0]=vf->offset;
 
