RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-25 16:52:31 +00:00
Code Issues Projects Releases Wiki Activity

avutil/mem: Fix potential overflow in overallocation code

Browse Source 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-07-11 22:47:09 +02:00
parent bc976e5793
commit b3415e4c5f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavutil/mem.c
View File

@ -480,7 +480,7 @@ void *av_fast_realloc(void *ptr, unsigned int *size, size_t min_size)
if (min_size < *size) if (min_size < *size)
return ptr; return ptr;
min_size = FFMAX(17 * min_size / 16 + 32, min_size); min_size = FFMAX(min_size + min_size / 16 + 32, min_size);
ptr = av_realloc(ptr, min_size); ptr = av_realloc(ptr, min_size);
/* we could set this to the unmodified min_size but this is safer /* we could set this to the unmodified min_size but this is safer
@ -500,7 +500,7 @@ static inline int ff_fast_malloc(void *ptr, unsigned int *size, size_t min_size,
if (min_size < *size) if (min_size < *size)
return 0; return 0;
min_size = FFMAX(17 * min_size / 16 + 32, min_size); min_size = FFMAX(min_size + min_size / 16 + 32, min_size);
av_freep(ptr); av_freep(ptr);
val = zero_realloc ? av_mallocz(min_size) : av_malloc(min_size); val = zero_realloc ? av_mallocz(min_size) : av_malloc(min_size);
memcpy(ptr, &val, sizeof(val)); memcpy(ptr, &val, sizeof(val));