diff -urN tremor-svn-r18116-orig/block.c tremor-svn-r18116/block.c
--- tremor-svn-r18116-orig/block.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/block.c	2014-05-19 00:48:22 +0900
@@ -95,6 +95,7 @@
     /* can't just _ogg_realloc... there are outstanding pointers */
     if(vb->localstore){
       struct alloc_chain *link=(struct alloc_chain *)_ogg_malloc(sizeof(*link));
+      if(!link) return NULL;
       vb->totaluse+=vb->localtop;
       link->next=vb->reap;
       link->ptr=vb->localstore;
@@ -104,6 +105,10 @@
     vb->localalloc=bytes;
     vb->localstore=_ogg_malloc(vb->localalloc);
     vb->localtop=0;
+    if(!vb->localstore){
+      vb->localalloc=0;
+      return NULL;
+    }
   }
   {
     void *ret=(void *)(((char *)vb->localstore)+vb->localtop);
@@ -125,8 +130,11 @@
   }
   /* consolidate storage */
   if(vb->totaluse){
-    vb->localstore=_ogg_realloc(vb->localstore,vb->totaluse+vb->localalloc);
-    vb->localalloc+=vb->totaluse;
+    void*newstore=_ogg_realloc(vb->localstore,vb->totaluse+vb->localalloc);
+    if(newstore){
+      vb->localstore=newstore;
+      vb->localalloc+=vb->totaluse;
+    }
     vb->totaluse=0;
   }
 
@@ -152,6 +160,7 @@
 
   memset(v,0,sizeof(*v));
   b=(private_state *)(v->backend_state=_ogg_calloc(1,sizeof(*b)));
+  if(!b) return -1;
 
   v->vi=vi;
   b->modebits=ilog(ci->modes);
@@ -163,6 +172,7 @@
   /* finish the codebooks */
   if(!ci->fullbooks){
     ci->fullbooks=(codebook *)_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
+    if(!ci->fullbooks) goto abort_clear;
     for(i=0;i<ci->books;i++){
       if(ci->book_param[i]==NULL)
         goto abort_books;
@@ -176,9 +186,14 @@
 
   v->pcm_storage=ci->blocksizes[1];
   v->pcm=(ogg_int32_t **)_ogg_malloc(vi->channels*sizeof(*v->pcm));
-  v->pcmret=(ogg_int32_t **)_ogg_malloc(vi->channels*sizeof(*v->pcmret));
+  if(!v->pcm) goto abort_clear;
   for(i=0;i<vi->channels;i++)
     v->pcm[i]=(ogg_int32_t *)_ogg_calloc(v->pcm_storage,sizeof(*v->pcm[i]));
+  for(i=0;i<vi->channels;i++){
+    if(!v->pcm[i]) goto abort_clear;
+  }
+  v->pcmret=(ogg_int32_t **)_ogg_malloc(vi->channels*sizeof(*v->pcmret));
+  if(!v->pcmret) goto abort_clear;
 
   /* all 1 (large block) or 0 (small block) */
   /* explicitly set for the sake of clarity */
@@ -187,12 +202,16 @@
 
   /* initialize all the mapping/backend lookups */
   b->mode=(vorbis_look_mapping **)_ogg_calloc(ci->modes,sizeof(*b->mode));
+  if(!b->mode) goto abort_clear;
   for(i=0;i<ci->modes;i++){
     int mapnum=ci->mode_param[i]->mapping;
     int maptype=ci->map_type[mapnum];
     b->mode[i]=_mapping_P[maptype]->look(v,ci->mode_param[i],
 					 ci->map_param[mapnum]);
   }
+  for(i=0;i<ci->modes;i++){
+    if(!b->mode[i]) goto abort_clear;
+  }
   return 0;
 abort_books:
   for(i=0;i<ci->books;i++){
@@ -201,6 +220,7 @@
       ci->book_param[i]=NULL;
     }
   }
+ abort_clear:
   vorbis_dsp_clear(v);
   return -1;
 }
diff -urN tremor-svn-r18116-orig/codebook.c tremor-svn-r18116/codebook.c
--- tremor-svn-r18116-orig/codebook.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/codebook.c	2014-05-19 00:48:14 +0900
@@ -28,6 +28,7 @@
 static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
   long i,j;
   static_codebook *s=_ogg_calloc(1,sizeof(*s));
+  if(!s)goto _errout;
 
   /* make sure alignment is correct */
   if(oggpack_read(opb,24)!=0x564342)goto _eofout;
@@ -49,6 +50,7 @@
       goto _eofout;
     /* unordered */
     s->lengthlist=(long *)_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
+    if(!s->lengthlist)goto _errout;
 
     /* allocated but unused entries? */
     if(unused){
@@ -79,6 +81,7 @@
       long length=oggpack_read(opb,5)+1;
       if(length==0)goto _eofout;
       s->lengthlist=(long *)_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
+      if(!s->lengthlist)goto _errout;
 
       for(i=0;i<s->entries;){
 	long num=oggpack_read(opb,_ilog(s->entries-i));
@@ -128,6 +131,7 @@
       if((quantvals*s->q_quant+7)>>3>opb->storage-oggpack_bytes(opb))
         goto _eofout;
       s->quantlist=(long *)_ogg_malloc(sizeof(*s->quantlist)*quantvals);
+      if(!s->quantlist)goto _errout;
       for(i=0;i<quantvals;i++)
 	s->quantlist[i]=oggpack_read(opb,s->q_quant);
       
@@ -143,7 +147,7 @@
   
  _errout:
  _eofout:
-  vorbis_staticbook_destroy(s);
+  if(s)vorbis_staticbook_destroy(s);
   return(NULL); 
 }
 
diff -urN tremor-svn-r18116-orig/floor0.c tremor-svn-r18116/floor0.c
--- tremor-svn-r18116-orig/floor0.c	2014-05-19 00:23:45 +0900
+++ tremor-svn-r18116/floor0.c	2014-05-19 00:48:14 +0900
@@ -312,6 +312,7 @@
   int j;
 
   vorbis_info_floor0 *info=(vorbis_info_floor0 *)_ogg_malloc(sizeof(*info));
+  if(!info)goto err_out;
   info->order=oggpack_read(opb,8);
   info->rate=oggpack_read(opb,16);
   info->barkmap=oggpack_read(opb,16);
@@ -352,6 +353,7 @@
   codec_setup_info   *ci=(codec_setup_info *)vi->codec_setup;
   vorbis_info_floor0 *info=(vorbis_info_floor0 *)i;
   vorbis_look_floor0 *look=(vorbis_look_floor0 *)_ogg_calloc(1,sizeof(*look));
+  if(!look)goto err_out;
   look->m=info->order;
   look->n=ci->blocksizes[mi->blockflag]/2;
   look->ln=info->barkmap;
@@ -364,6 +366,7 @@
      necessary in some mapping combinations to keep the scale spacing
      accurate */
   look->linearmap=(int *)_ogg_malloc((look->n+1)*sizeof(*look->linearmap));
+  if(!look->linearmap)goto err_out;
   for(j=0;j<look->n;j++){
 
     int val=(look->ln*
@@ -379,6 +382,10 @@
     look->lsp_look[j]=vorbis_coslook2_i(0x10000*j/look->ln);
 
   return look;
+
+ err_out:
+  floor0_free_look(look);
+  return(NULL);
 }
 
 static void *floor0_inverse1(vorbis_block *vb,vorbis_look_floor *i){
diff -urN tremor-svn-r18116-orig/floor1.c tremor-svn-r18116/floor1.c
--- tremor-svn-r18116-orig/floor1.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/floor1.c	2014-05-19 00:48:14 +0900
@@ -77,6 +77,7 @@
   int j,k,count=0,maxclass=-1,rangebits;
 
   vorbis_info_floor1 *info=(vorbis_info_floor1 *)_ogg_calloc(1,sizeof(*info));
+  if(!info)goto err_out;
   /* read partitions */
   info->partitions=oggpack_read(opb,5); /* only 0 to 31 legal */
   for(j=0;j<info->partitions;j++){
@@ -142,6 +143,7 @@
   vorbis_info_floor1 *info=(vorbis_info_floor1 *)in;
   vorbis_look_floor1 *look=(vorbis_look_floor1 *)_ogg_calloc(1,sizeof(*look));
   int i,j,n=0;
+  if(!look)return(NULL);
 
   look->vi=info;
   look->n=info->postlist[1];
@@ -334,6 +336,7 @@
   /* unpack wrapped/predicted values from stream */
   if(oggpack_read(&vb->opb,1)==1){
     int *fit_value=(int *)_vorbis_block_alloc(vb,(look->posts)*sizeof(*fit_value));
+    if(!fit_value)goto eop;
     
     fit_value[0]=oggpack_read(&vb->opb,ilog(look->quant_q-1));
     fit_value[1]=oggpack_read(&vb->opb,ilog(look->quant_q-1));
diff -urN tremor-svn-r18116-orig/info.c tremor-svn-r18116/info.c
--- tremor-svn-r18116-orig/info.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/info.c	2014-05-19 00:48:14 +0900
@@ -283,6 +283,7 @@
   if(ci->modes<=0)goto err_out;
   for(i=0;i<ci->modes;i++){
     ci->mode_param[i]=(vorbis_info_mode *)_ogg_calloc(1,sizeof(*ci->mode_param[i]));
+    if(!ci->mode_param[i])goto err_out;
     ci->mode_param[i]->blockflag=oggpack_read(opb,1);
     ci->mode_param[i]->windowtype=oggpack_read(opb,16);
     ci->mode_param[i]->transformtype=oggpack_read(opb,16);
diff -urN tremor-svn-r18116-orig/mapping0.c tremor-svn-r18116/mapping0.c
--- tremor-svn-r18116-orig/mapping0.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/mapping0.c	2014-05-19 00:48:22 +0900
@@ -67,8 +67,10 @@
   if(l){
 
     for(i=0;i<l->map->submaps;i++){
-      l->floor_func[i]->free_look(l->floor_look[i]);
-      l->residue_func[i]->free_look(l->residue_look[i]);
+      if(l->floor_func&&l->floor_func[i]&&l->floor_look&&l->floor_look[i])
+        l->floor_func[i]->free_look(l->floor_look[i]);
+      if(l->residue_func&&l->residue_func[i]&&l->residue_look&&l->residue_look[i])
+        l->residue_func[i]->free_look(l->residue_look[i]);
     }
 
     _ogg_free(l->floor_func);
@@ -86,15 +88,20 @@
   vorbis_info          *vi=vd->vi;
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   vorbis_look_mapping0 *look=(vorbis_look_mapping0 *)_ogg_calloc(1,sizeof(*look));
+  if(!look)goto err_out;
   vorbis_info_mapping0 *info=look->map=(vorbis_info_mapping0 *)m;
   look->mode=vm;
   
   look->floor_look=(vorbis_look_floor **)_ogg_calloc(info->submaps,sizeof(*look->floor_look));
+  if(!look->floor_look)goto err_out;
 
   look->residue_look=(vorbis_look_residue **)_ogg_calloc(info->submaps,sizeof(*look->residue_look));
+  if(!look->residue_look)goto err_out;
 
   look->floor_func=(vorbis_func_floor **)_ogg_calloc(info->submaps,sizeof(*look->floor_func));
+  if(!look->floor_func)goto err_out;
   look->residue_func=(vorbis_func_residue **)_ogg_calloc(info->submaps,sizeof(*look->residue_func));
+  if(!look->residue_func)goto err_out;
   
   for(i=0;i<info->submaps;i++){
     int floornum=info->floorsubmap[i];
@@ -112,6 +119,10 @@
   look->ch=vi->channels;
 
   return(look);
+
+ err_out:
+  mapping0_free_look(look);
+  return(NULL);
 }
 
 static int ilog(unsigned int v){
@@ -129,6 +140,7 @@
   int i,b;
   vorbis_info_mapping0 *info=(vorbis_info_mapping0 *)_ogg_calloc(1,sizeof(*info));
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
+  if(!info)goto err_out;
   memset(info,0,sizeof(*info));
 
   b=oggpack_read(opb,1);
diff -urN tremor-svn-r18116-orig/res012.c tremor-svn-r18116/res012.c
--- tremor-svn-r18116-orig/res012.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/res012.c	2014-05-19 00:48:14 +0900
@@ -56,12 +56,16 @@
 
     vorbis_look_residue0 *look=(vorbis_look_residue0 *)i;
 
-    for(j=0;j<look->parts;j++)
-      if(look->partbooks[j])_ogg_free(look->partbooks[j]);
-    _ogg_free(look->partbooks);
-    for(j=0;j<look->partvals;j++)
-      _ogg_free(look->decodemap[j]);
-    _ogg_free(look->decodemap);
+    if(look->partbooks){
+      for(j=0;j<look->parts;j++)
+        if(look->partbooks[j])_ogg_free(look->partbooks[j]);
+      _ogg_free(look->partbooks);
+    }
+    if(look->decodemap){
+      for(j=0;j<look->partvals;j++)
+        _ogg_free(look->decodemap[j]);
+      _ogg_free(look->decodemap);
+    }
 
     memset(look,0,sizeof(*look));
     _ogg_free(look);
@@ -91,6 +95,7 @@
   int j,acc=0;
   vorbis_info_residue0 *info=(vorbis_info_residue0 *)_ogg_calloc(1,sizeof(*info));
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
+  if(!info)goto errout;
 
   info->begin=oggpack_read(opb,24);
   info->end=oggpack_read(opb,24);
@@ -156,6 +161,7 @@
   vorbis_info_residue0 *info=(vorbis_info_residue0 *)vr;
   vorbis_look_residue0 *look=(vorbis_look_residue0 *)_ogg_calloc(1,sizeof(*look));
   codec_setup_info     *ci=(codec_setup_info *)vd->vi->codec_setup;
+  if(!look)goto errout;
 
   int j,k,acc=0;
   int dim;
@@ -169,18 +175,21 @@
   dim=look->phrasebook->dim;
 
   look->partbooks=(codebook ***)_ogg_calloc(look->parts,sizeof(*look->partbooks));
+  if(!look->partbooks)goto errout;
 
   for(j=0;j<look->parts;j++){
     int stages=ilog(info->secondstages[j]);
     if(stages){
       if(stages>maxstage)maxstage=stages;
       look->partbooks[j]=(codebook **)_ogg_calloc(stages,sizeof(*look->partbooks[j]));
+      if(!look->partbooks[j])goto errout;
       for(k=0;k<stages;k++)
 	if(info->secondstages[j]&(1<<k)){
 	  look->partbooks[j][k]=ci->fullbooks+info->booklist[acc++];
 #ifdef TRAIN_RES
 	  look->training_data[k][j]=calloc(look->partbooks[j][k]->entries,
 					   sizeof(***look->training_data));
+          if(!look->training_data[k][j])goto errout;
 #endif
 	}
     }
@@ -189,11 +198,13 @@
   look->partvals=look->parts;
   for(j=1;j<dim;j++)look->partvals*=look->parts;
   look->stages=maxstage;
-  look->decodemap=(int **)_ogg_malloc(look->partvals*sizeof(*look->decodemap));
+  look->decodemap=(int **)_ogg_calloc(look->partvals,sizeof(*look->decodemap));
+  if(!look->decodemap)goto errout;
   for(j=0;j<look->partvals;j++){
     long val=j;
     long mult=look->partvals/look->parts;
     look->decodemap[j]=(int *)_ogg_malloc(dim*sizeof(*look->decodemap[j]));
+    if(!look->decodemap[j])goto errout;
     for(k=0;k<dim;k++){
       long deco=val/mult;
       val-=deco*mult;
@@ -203,6 +214,10 @@
   }
 
   return(look);
+
+ errout:
+  res0_free_look(look);
+  return(NULL);
 }
 
 
@@ -228,8 +243,10 @@
     int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
     int ***partword=(int ***)alloca(ch*sizeof(*partword));
     
-    for(j=0;j<ch;j++)
+    for(j=0;j<ch;j++){
       partword[j]=(int **)_vorbis_block_alloc(vb,partwords*sizeof(*partword[j]));
+      if(!partword[j])goto errout;
+    }
     
     for(s=0;s<look->stages;s++){
       
diff -urN tremor-svn-r18116-orig/sharedbook.c tremor-svn-r18116/sharedbook.c
--- tremor-svn-r18116-orig/sharedbook.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/sharedbook.c	2014-05-19 00:48:14 +0900
@@ -71,6 +71,8 @@
   long i,j,count=0;
   ogg_uint32_t marker[33];
   ogg_uint32_t *r=(ogg_uint32_t *)_ogg_malloc((sparsecount?sparsecount:n)*sizeof(*r));
+  if(!r)
+    return(NULL);
   memset(marker,0,sizeof(marker));
 
   for(i=0;i<n;i++){
@@ -200,7 +202,12 @@
     ogg_int32_t mindel=_float32_unpack(b->q_min,&minpoint);
     ogg_int32_t delta=_float32_unpack(b->q_delta,&delpoint);
     ogg_int32_t *r=(ogg_int32_t *)_ogg_calloc(n*b->dim,sizeof(*r));
+    if(!r)return(NULL);
     int *rp=(int *)_ogg_calloc(n*b->dim,sizeof(*rp));
+    if(!rp){
+      _ogg_free(r);
+      return(NULL);
+    }
 
     *maxpoint=minpoint;
 
@@ -368,6 +375,10 @@
 
     sortindex=(int *)alloca(n*sizeof(*sortindex));
     c->codelist=(ogg_uint32_t *)_ogg_malloc(n*sizeof(*c->codelist));
+    if(c->codelist==NULL){
+      _ogg_free(codes);
+      goto err_out;
+    }
     /* the index is a reverse index */
     for(i=0;i<n;i++){
       int position=codep[i]-codes;
@@ -382,12 +393,14 @@
     
     c->valuelist=_book_unquantize(s,n,sortindex,&c->binarypoint);
     c->dec_index=(int *)_ogg_malloc(n*sizeof(*c->dec_index));
+    if(c->dec_index==NULL)goto err_out;
     
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0)
 	c->dec_index[sortindex[n++]]=i;
     
     c->dec_codelengths=(char *)_ogg_malloc(n*sizeof(*c->dec_codelengths));
+    if(c->dec_codelengths==NULL)goto err_out;
     for(n=0,i=0;i<s->entries;i++)
       if(s->lengthlist[i]>0)
 	c->dec_codelengths[sortindex[n++]]=s->lengthlist[i];
@@ -398,6 +411,7 @@
     
     tabn=1<<c->dec_firsttablen;
     c->dec_firsttable=(ogg_uint32_t *)_ogg_calloc(tabn,sizeof(*c->dec_firsttable));
+    if(c->dec_firsttable==NULL)goto err_out;
     c->dec_maxlength=0;
     
     for(i=0;i<n;i++){
diff -urN tremor-svn-r18116-orig/synthesis.c tremor-svn-r18116/synthesis.c
--- tremor-svn-r18116-orig/synthesis.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/synthesis.c	2014-05-19 00:48:14 +0900
@@ -74,8 +74,12 @@
     /* alloc pcm passback storage */
     vb->pcmend=ci->blocksizes[vb->W];
     vb->pcm=(ogg_int32_t **)_vorbis_block_alloc(vb,sizeof(*vb->pcm)*vi->channels);
+    if(!vb->pcm) return(OV_EFAULT);
     for(i=0;i<vi->channels;i++)
       vb->pcm[i]=(ogg_int32_t *)_vorbis_block_alloc(vb,vb->pcmend*sizeof(*vb->pcm[i]));
+    for(i=0;i<vi->channels;i++){
+      if(!vb->pcm[i]) return(OV_EFAULT);
+    }
     
     /* unpack_header enforces range checking */
     type=ci->map_type[ci->mode_param[mode]->mapping];
diff -urN tremor-svn-r18116-orig/vorbisfile.c tremor-svn-r18116/vorbisfile.c
--- tremor-svn-r18116-orig/vorbisfile.c	2014-05-19 00:23:46 +0900
+++ tremor-svn-r18116/vorbisfile.c	2014-05-19 00:48:14 +0900
@@ -64,6 +64,7 @@
   if(!(vf->callbacks.read_func))return(-1);
   if(vf->datasource){
     char *buffer=ogg_sync_buffer(&vf->oy,CHUNKSIZE);
+    if(!buffer)return(-1);
     long bytes=(vf->callbacks.read_func)(buffer,1,CHUNKSIZE,vf->datasource);
     if(bytes>0)ogg_sync_wrote(&vf->oy,bytes);
     if(bytes==0 && errno)return(-1);
@@ -185,10 +186,20 @@
   (*n)++;
 
   if(*serialno_list){
-    *serialno_list = _ogg_realloc(*serialno_list, sizeof(**serialno_list)*(*n));
+    ogg_uint32_t *new_list = _ogg_realloc(*serialno_list, sizeof(**serialno_list)*(*n));
+    if(!new_list){
+      _ogg_free(*serialno_list);
+      *serialno_list = NULL;
+    }else{
+      *serialno_list = new_list;
+    }
   }else{
     *serialno_list = _ogg_malloc(sizeof(**serialno_list));
   }
+  if(!*serialno_list){
+    (*n) = 0;
+    return;
+  }
 
   (*serialno_list)[(*n)-1] = s;
 }
@@ -489,6 +500,9 @@
        find the last vorbis page belonging to the first vorbis stream
        for this link. */
 
+    vorbis_info *vi;
+    vorbis_comment *vc;
+
     while(endserial != serialno){
       endserial = serialno;
       vf->offset=_get_prev_page_serial(vf,currentno_list,currentnos,&endserial,&endgran);
@@ -500,11 +514,17 @@
     if(vf->dataoffsets)_ogg_free(vf->dataoffsets);
 
     vf->offsets=_ogg_malloc((vf->links+1)*sizeof(*vf->offsets));
-    vf->vi=_ogg_realloc(vf->vi,vf->links*sizeof(*vf->vi));
-    vf->vc=_ogg_realloc(vf->vc,vf->links*sizeof(*vf->vc));
+    vi=_ogg_realloc(vf->vi,vf->links*sizeof(*vf->vi));
+    if(vi)vf->vi=vi;
+    vc=_ogg_realloc(vf->vc,vf->links*sizeof(*vf->vc));
+    if(vc)vf->vc=vc;
     vf->serialnos=_ogg_malloc(vf->links*sizeof(*vf->serialnos));
     vf->dataoffsets=_ogg_malloc(vf->links*sizeof(*vf->dataoffsets));
     vf->pcmlengths=_ogg_malloc(vf->links*2*sizeof(*vf->pcmlengths));
+    if(!vf->offsets||!vi||!vc||!vf->serialnos||!vf->dataoffsets||!vf->pcmlengths){
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
 
     vf->offsets[m+1]=end;
     vf->offsets[m]=begin;
@@ -898,6 +918,10 @@
   vf->links=1;
   vf->vi=_ogg_calloc(vf->links,sizeof(*vf->vi));
   vf->vc=_ogg_calloc(vf->links,sizeof(*vf->vc));
+  if(!vf->vi||!vf->vc){
+    ov_clear(vf);
+    return(OV_EFAULT);
+  }
   ogg_stream_init(&vf->os,-1); /* fill in the serialno later */
 
   /* Fetch all BOS pages, store the vorbis header and all seen serial
@@ -910,12 +934,22 @@
        for second stage of seekable stream open; this saves having to
        seek/reread first link's serialnumber data then. */
     vf->serialnos=_ogg_calloc(serialno_list_size+2,sizeof(*vf->serialnos));
+    if(!vf->serialnos){
+      if(serialno_list)_ogg_free(serialno_list);
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
     vf->serialnos[0]=vf->current_serialno=vf->os.serialno;
     vf->serialnos[1]=serialno_list_size;
     memcpy(vf->serialnos+2,serialno_list,serialno_list_size*sizeof(*vf->serialnos));
 
     vf->offsets=_ogg_calloc(1,sizeof(*vf->offsets));
     vf->dataoffsets=_ogg_calloc(1,sizeof(*vf->dataoffsets));
+    if(!vf->offsets||!vf->dataoffsets){
+      if(serialno_list)_ogg_free(serialno_list);
+      ov_clear(vf);
+      return(OV_EFAULT);
+    }
     vf->offsets[0]=0;
     vf->dataoffsets[0]=vf->offset;
 
