diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2025-06-03 16:44:08 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2025-06-06 16:27:12 +0200 |
| commit | abebdb1bdb737f92edc88aaea71395649a85e37c (patch) | |
| tree | 5333467aa47813b846b8b4caf5992880a0428ea0 /libavutil/frame.c | |
| parent | 4bd1ce31fc72ae153b78b87d791a598f06fead9e (diff) | |
| download | ffmpeg-abebdb1bdb737f92edc88aaea71395649a85e37c.tar.gz | |
avutil/frame: Always return error upon error
(I don't know whether this can be triggered for a file with
nonnegative channel count, given that src's extended data can't
have been allocated in this case.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavutil/frame.c')
| -rw-r--r-- | libavutil/frame.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/libavutil/frame.c b/libavutil/frame.c index dcfc835626..569059c45c 100644 --- a/libavutil/frame.c +++ b/libavutil/frame.c @@ -456,14 +456,11 @@ int av_frame_replace(AVFrame *dst, const AVFrame *src) if (src->extended_data != src->data) { int ch = dst->ch_layout.nb_channels; - if (!ch) { + if (ch <= 0 || ch > SIZE_MAX / sizeof(*dst->extended_data)) { ret = AVERROR(EINVAL); goto fail; } - if (ch > SIZE_MAX / sizeof(*dst->extended_data)) - goto fail; - dst->extended_data = av_memdup(src->extended_data, sizeof(*dst->extended_data) * ch); if (!dst->extended_data) { ret = AVERROR(ENOMEM); |