diff options
| author | James Almer <jamrial@gmail.com> | 2016-11-19 14:33:10 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2016-11-19 20:11:50 -0300 |
| commit | 0ffea3565700c9b3093ead285f729bb319a2163e (patch) | |
| tree | 61e05654100618e9e196e18e480291de03522be0 /libavformat | |
| parent | 2343f23e4d7e0d0f6adfd83d7d769a7a115dbd17 (diff) | |
| download | ffmpeg-0ffea3565700c9b3093ead285f729bb319a2163e.tar.gz | |
avformat/utils: check for overflow before reallocating side data
This makes av_stream_add_side_data() consistent with av_packet_add_side_data().
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/utils.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/utils.c b/libavformat/utils.c index 19bb8bd420..9d01babaf4 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -5121,7 +5121,10 @@ int av_stream_add_side_data(AVStream *st, enum AVPacketSideDataType type, } } - tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, sizeof(*tmp)); + if ((unsigned)st->nb_side_data + 1 >= INT_MAX / sizeof(*st->side_data)) + return AVERROR(ERANGE); + + tmp = av_realloc(st->side_data, st->nb_side_data + 1 * sizeof(*tmp)); if (!tmp) { return AVERROR(ENOMEM); } |