use av_malloc() in vorbis_comment()

Originally committed as revision 17188 to svn://svn.ffmpeg.org/ffmpeg/trunk

1 files changed, 13 insertions, 2 deletions

diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
index a74fb9a9ff..7c97807c01 100644
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -71,8 +71,16 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
         v++;
 
         if (tl && vl) {
-            char tt[tl + 1];
-            char ct[vl + 1];
+            char *tt, *ct;
+
+            tt = av_malloc(tl + 1);
+            ct = av_malloc(vl + 1);
+            if (!tt || !ct) {
+                av_freep(&tt);
+                av_freep(&ct);
+                av_log(as, AV_LOG_WARNING, "out-of-memory error. skipping VorbisComment tag.\n");
+                continue;
+            }
 
             for (j = 0; j < tl; j++)
                 tt[j] = toupper(t[j]);
@@ -82,6 +90,9 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
             ct[vl] = 0;
 
             av_metadata_set(&as->metadata, tt, ct);
+
+            av_freep(&tt);
+            av_freep(&ct);
         }
     }