diff --git a/libavformat/4xm.c b/libavformat/4xm.c index c1d5f67e8c..b45fd05b1d 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -151,8 +151,9 @@ static int fourxm_read_header(AVFormatContext *s, } current_track = LE_32(&header[i + 8]); if (current_track + 1 > fourxm->track_count) { - fourxm->track_count++; - fourxm->tracks = av_realloc(fourxm->tracks, fourxm->track_count); + fourxm->track_count = current_track + 1; + fourxm->tracks = av_realloc(fourxm->tracks, + fourxm->track_count * sizeof(AudioTrack)); if (!fourxm->tracks) { av_free(header); return AVERROR_NOMEM;