From daa290580dade36a69544a191e6983e920885c16 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 1 Feb 2012 06:05:12 +0100 Subject: [PATCH] mxfdec: simplify code by using av_calloc() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewed a long time ago by: Tomas Härdin Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index a553eb5630..00774ee0b3 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -410,12 +410,14 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U item_len); return AVERROR_PATCHWELCOME; } - if (item_num > UINT_MAX / item_len) + if (item_num > 65536) { + av_log(mxf->fc, AV_LOG_ERROR, "item_num %d is too large\n", item_num); return AVERROR_INVALIDDATA; - mxf->local_tags_count = item_num; - mxf->local_tags = av_malloc(item_num*item_len); + } + mxf->local_tags = av_calloc(item_num, item_len); if (!mxf->local_tags) return AVERROR(ENOMEM); + mxf->local_tags_count = item_num; avio_read(pb, mxf->local_tags, item_num*item_len); return 0; } @@ -585,9 +587,7 @@ static int mxf_read_content_storage(void *arg, AVIOContext *pb, int tag, int siz switch (tag) { case 0x1901: mxf->packages_count = avio_rb32(pb); - if (mxf->packages_count >= UINT_MAX / sizeof(UID)) - return AVERROR_INVALIDDATA; - mxf->packages_refs = av_malloc(mxf->packages_count * sizeof(UID)); + mxf->packages_refs = av_calloc(mxf->packages_count, sizeof(UID)); if (!mxf->packages_refs) return AVERROR(ENOMEM); avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ @@ -625,9 +625,7 @@ static int mxf_read_material_package(void *arg, AVIOContext *pb, int tag, int si switch(tag) { case 0x4403: package->tracks_count = avio_rb32(pb); - if (package->tracks_count >= UINT_MAX / sizeof(UID)) - return AVERROR_INVALIDDATA; - package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID)); + package->tracks_refs = av_calloc(package->tracks_count, sizeof(UID)); if (!package->tracks_refs) return AVERROR(ENOMEM); avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ @@ -687,9 +685,7 @@ static int mxf_read_sequence(void *arg, AVIOContext *pb, int tag, int size, UID break; case 0x1001: sequence->structural_components_count = avio_rb32(pb); - if (sequence->structural_components_count >= UINT_MAX / sizeof(UID)) - return AVERROR_INVALIDDATA; - sequence->structural_components_refs = av_malloc(sequence->structural_components_count * sizeof(UID)); + sequence->structural_components_refs = av_calloc(sequence->structural_components_count, sizeof(UID)); if (!sequence->structural_components_refs) return AVERROR(ENOMEM); avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ @@ -705,9 +701,7 @@ static int mxf_read_source_package(void *arg, AVIOContext *pb, int tag, int size switch(tag) { case 0x4403: package->tracks_count = avio_rb32(pb); - if (package->tracks_count >= UINT_MAX / sizeof(UID)) - return AVERROR_INVALIDDATA; - package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID)); + package->tracks_refs = av_calloc(package->tracks_count, sizeof(UID)); if (!package->tracks_refs) return AVERROR(ENOMEM); avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ @@ -811,9 +805,7 @@ static int mxf_read_generic_descriptor(void *arg, AVIOContext *pb, int tag, int switch(tag) { case 0x3F01: descriptor->sub_descriptors_count = avio_rb32(pb); - if (descriptor->sub_descriptors_count >= UINT_MAX / sizeof(UID)) - return AVERROR_INVALIDDATA; - descriptor->sub_descriptors_refs = av_malloc(descriptor->sub_descriptors_count * sizeof(UID)); + descriptor->sub_descriptors_refs = av_calloc(descriptor->sub_descriptors_count, sizeof(UID)); if (!descriptor->sub_descriptors_refs) return AVERROR(ENOMEM); avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */