diff --git a/ffserver.c b/ffserver.c index 45250c6303..86e21d051d 100644 --- a/ffserver.c +++ b/ffserver.c @@ -1317,13 +1317,21 @@ static void http_write_packet(void *opaque, c->buffer_ptr = c->buffer_end = c->buffer; if (c->buffer_end - c->buffer + size > c->buffer_size) { - UINT8 *new_buffer = av_malloc(c->buffer_size * 2); + int new_buffer_size = c->buffer_size * 2; + UINT8 *new_buffer; + + if (new_buffer_size <= c->buffer_end - c->buffer + size) { + new_buffer_size = c->buffer_end - c->buffer + size + c->buffer_size; + } + + new_buffer = av_malloc(new_buffer_size); if (new_buffer) { memcpy(new_buffer, c->buffer, c->buffer_end - c->buffer); c->buffer_end += (new_buffer - c->buffer); c->buffer_ptr += (new_buffer - c->buffer); av_free(c->buffer); c->buffer = new_buffer; + c->buffer_size = new_buffer_size; } else { av_abort(); }