sws_allocVec: check length validity

Found-by: Reimar
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 6 insertions, 1 deletions

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 24058c3b0c..03e9463773 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1415,7 +1415,12 @@ SwsFilter *sws_getDefaultFilter(float lumaGBlur, float chromaGBlur,
 
 SwsVector *sws_allocVec(int length)
 {
-    SwsVector *vec = av_malloc(sizeof(SwsVector));
+    SwsVector *vec;
+
+    if(length <= 0 || length > INT_MAX/ sizeof(double))
+        return NULL;
+
+    vec = av_malloc(sizeof(SwsVector));
     if (!vec)
         return NULL;
     vec->length = length;