diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-03-22 15:24:47 +0100 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-03-22 23:38:36 +0100 |
| commit | d11b5e6096b888caa7e6c4d159f6c0c44d0ca83d (patch) | |
| tree | 66d4803f906b94834bcf96d964220751b0576100 | |
| parent | b7bec5d3c9ec0d38175d3385b37d85de26c96470 (diff) | |
| download | ffmpeg-d11b5e6096b888caa7e6c4d159f6c0c44d0ca83d.tar.gz | |
avutil/frame: Use av_realloc_array(), improve overflow check
Also use sizeof of the proper type, namely sizeof(**sd)
and not sizeof(*sd).
Reviewed-by: Jan Ekström <jeebjp@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavutil/frame.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavutil/frame.c b/libavutil/frame.c index 7dd37e5490..d7a32cdc92 100644 --- a/libavutil/frame.c +++ b/libavutil/frame.c @@ -721,10 +721,11 @@ static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd, if (!buf) return NULL; - if (*nb_sd > INT_MAX / sizeof(*sd) - 1) + // *nb_sd + 1 needs to fit into an int and a size_t. + if ((unsigned)*nb_sd >= FFMIN(INT_MAX, SIZE_MAX)) return NULL; - tmp = av_realloc(*sd, (*nb_sd + 1) * sizeof(*sd)); + tmp = av_realloc_array(*sd, sizeof(**sd), *nb_sd + 1); if (!tmp) return NULL; *sd = tmp; |