diff options
| author | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2009-03-21 00:50:51 +0000 |
|---|---|---|
| committer | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2009-03-21 00:50:51 +0000 |
| commit | b4800b8b7dfba22117d8edd02164b00c83ae3753 (patch) | |
| tree | b9968c51ea1b5464b51cba2f39932d594018de77 | |
| parent | b9b4fc5e0733d52925b4cda1dc3828218c199bd8 (diff) | |
| download | ffmpeg-b4800b8b7dfba22117d8edd02164b00c83ae3753.tar.gz | |
protect realloc overflow
Originally committed as revision 18088 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/mxfdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 3933d4c87e..73b0a77d2b 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -364,6 +364,8 @@ static int mxf_read_primer_pack(MXFContext *mxf) static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set) { + if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets)) + return AVERROR(ENOMEM); mxf->metadata_sets = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets)); if (!mxf->metadata_sets) return -1; |