diff options
| author | Hugo Beauzée-Luyssen <hugo@beauzee.fr> | 2015-02-01 19:19:46 +0100 |
|---|---|---|
| committer | Vittorio Giovara <vittorio.giovara@gmail.com> | 2015-02-17 12:16:43 -0500 |
| commit | da7e31a240f276836a0b90ca6c0714181b353cc4 (patch) | |
| tree | a2acccb101b0a3008b97b3abd6ec38b5c8cee8df /libavformat | |
| parent | d89e58f53939d91a88aa7042c94d9d1cd364da52 (diff) | |
| download | ffmpeg-da7e31a240f276836a0b90ca6c0714181b353cc4.tar.gz | |
rmdec: Check memory allocations from ff_rm_alloc_rmstream()
Bug-Id: CID 1257835
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rdt.c | 2 | ||||
| -rw-r--r-- | libavformat/rmdec.c | 6 |
2 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/rdt.c b/libavformat/rdt.c index cc30694756..f2ec3e7563 100644 --- a/libavformat/rdt.c +++ b/libavformat/rdt.c @@ -434,6 +434,8 @@ rdt_parse_sdp_line (AVFormatContext *s, int st_index, rdt->nb_rmst = count; } rdt->rmst[s->streams[n]->index] = ff_rm_alloc_rmstream(); + if (!rdt->rmst[s->streams[n]->index]) + return AVERROR(ENOMEM); rdt_load_mdpr(rdt, s->streams[n], (n - first) * 2); } } diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index cae89a9c5a..15077646db 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -109,6 +109,8 @@ static void rm_read_metadata(AVFormatContext *s, AVIOContext *pb, int wide) RMStream *ff_rm_alloc_rmstream (void) { RMStream *rms = av_mallocz(sizeof(RMStream)); + if (!rms) + return NULL; rms->curpic_num = -1; return rms; } @@ -416,6 +418,8 @@ static int rm_read_header_old(AVFormatContext *s) if (!st) return -1; st->priv_data = ff_rm_alloc_rmstream(); + if (!st->priv_data) + return AVERROR(ENOMEM); return rm_read_audio_stream_info(s, s->pb, st, st->priv_data, 1); } @@ -493,6 +497,8 @@ static int rm_read_header(AVFormatContext *s) get_str8(pb, buf, sizeof(buf)); /* mimetype */ st->codec->codec_type = AVMEDIA_TYPE_DATA; st->priv_data = ff_rm_alloc_rmstream(); + if (!st->priv_data) + return AVERROR(ENOMEM); if (ff_rm_read_mdpr_codecdata(s, s->pb, st, st->priv_data, avio_rb32(pb)) < 0) return -1; |