From b4800b8b7dfba22117d8edd02164b00c83ae3753 Mon Sep 17 00:00:00 2001 From: Baptiste Coudurier Date: Sat, 21 Mar 2009 00:50:51 +0000 Subject: [PATCH] protect realloc overflow Originally committed as revision 18088 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavformat/mxfdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 3933d4c87e..73b0a77d2b 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -364,6 +364,8 @@ static int mxf_read_primer_pack(MXFContext *mxf) static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set) { + if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets)) + return AVERROR(ENOMEM); mxf->metadata_sets = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets)); if (!mxf->metadata_sets) return -1;