Merge commit 'f369b9356c4606cd4d713d60f7db5de119d901fa'

* commit 'f369b9356c4606cd4d713d60f7db5de119d901fa':
  avformat: Use av_reallocp_array() where suitable

Conflicts:
	libavformat/asfenc.c
	libavformat/gxfenc.c
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/asfenc.c

@@ -760,7 +760,7 @@ static void put_frame(AVFormatContext *s, ASFStream *stream, AVStream *avst,
     stream->seq++;
 }
 
-static void update_index(AVFormatContext *s, int start_sec,
+static int update_index(AVFormatContext *s, int start_sec,
                          uint32_t packet_number, uint16_t packet_count)
 {
     ASFContext *asf = s->priv_data;
@@ -774,8 +774,14 @@ static void update_index(AVFormatContext *s, int start_sec,
         }
 
         if (start_sec > asf->nb_index_memory_alloc) {
+            int err;
             asf->nb_index_memory_alloc = (start_sec + ASF_INDEX_BLOCK) & ~(ASF_INDEX_BLOCK - 1);
-            asf->index_ptr = av_realloc( asf->index_ptr, sizeof(ASFIndex) * asf->nb_index_memory_alloc );
+            if ((err = av_reallocp_array(&asf->index_ptr,
+                                         asf->nb_index_memory_alloc,
+                                         sizeof(*asf->index_ptr))) < 0) {
+                asf->nb_index_memory_alloc = 0;
+                return err;
+            }
         }
         for (i = asf->next_start_sec; i < start_sec; i++) {
             asf->index_ptr[i].packet_number = asf->next_packet_number;
@@ -786,6 +792,8 @@ static void update_index(AVFormatContext *s, int start_sec,
     asf->next_packet_number = packet_number;
     asf->next_packet_count  = packet_count;
     asf->next_start_sec     = start_sec;
+
+    return 0;
 }
 
 static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
@@ -797,6 +805,7 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
     int64_t pts;
     int start_sec;
     int flags = pkt->flags;
+    int ret;
 
     codec  = s->streams[pkt->stream_index]->codec;
     stream = &asf->streams[pkt->stream_index];
@@ -819,7 +828,8 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
     /* check index */
     if ((!asf->is_streamed) && (flags & AV_PKT_FLAG_KEY)) {
         uint16_t packet_count = asf->nb_packets - packet_number;
-        update_index(s, start_sec, packet_number, packet_count);
+        if ((ret = update_index(s, start_sec, packet_number, packet_count)) < 0)
+            return ret;
     }
     asf->end_sec = start_sec;
 
@@ -850,6 +860,7 @@ static int asf_write_trailer(AVFormatContext *s)
 {
     ASFContext *asf = s->priv_data;
     int64_t file_size, data_size;
+    int ret;
 
     /* flush the current packet */
     if (asf->pb.buf_ptr > asf->pb.buffer)
@@ -858,7 +869,8 @@ static int asf_write_trailer(AVFormatContext *s)
     /* write index */
     data_size = avio_tell(s->pb);
     if (!asf->is_streamed && asf->next_start_sec) {
-        update_index(s, asf->end_sec + 1, 0, 0);
+        if ((ret = update_index(s, asf->end_sec + 1, 0, 0)) < ret)
+            return ret;
         asf_write_index(s, asf->index_ptr, asf->maximum_packet, asf->next_start_sec);
     }
     avio_flush(s->pb);

libavformat/gxfenc.c

@@ -381,12 +381,13 @@ static int gxf_write_map_packet(AVFormatContext *s, int rewrite)
 
     if (!rewrite) {
         if (!(gxf->map_offsets_nb % 30)) {
-            gxf->map_offsets = av_realloc_f(gxf->map_offsets,
+            int err;
-                                            sizeof(*gxf->map_offsets),
+            if ((err = av_reallocp_array(&gxf->map_offsets,
-                                            gxf->map_offsets_nb+30);
+                                         gxf->map_offsets_nb + 30,
-            if (!gxf->map_offsets) {
+                                         sizeof(*gxf->map_offsets))) < 0) {
+                gxf->map_offsets_nb = 0;
                 av_log(s, AV_LOG_ERROR, "could not realloc map offsets\n");
-                return -1;
+                return err;
             }
         }
         gxf->map_offsets[gxf->map_offsets_nb++] = pos; // do not increment here
@@ -956,12 +957,13 @@ static int gxf_write_packet(AVFormatContext *s, AVPacket *pkt)
 
     if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {
         if (!(gxf->flt_entries_nb % 500)) {
-            gxf->flt_entries = av_realloc_f(gxf->flt_entries,
+            int err;
-                                            sizeof(*gxf->flt_entries),
+            if ((err = av_reallocp_array(&gxf->flt_entries,
-                                            gxf->flt_entries_nb+500);
+                                         gxf->flt_entries_nb + 500,
-            if (!gxf->flt_entries) {
+                                         sizeof(*gxf->flt_entries))) < 0) {
+                gxf->flt_entries_nb = 0;
                 av_log(s, AV_LOG_ERROR, "could not reallocate flt entries\n");
-                return -1;
+                return err;
             }
         }
         gxf->flt_entries[gxf->flt_entries_nb++] = packet_start_offset;

libavformat/matroskadec.c

@@ -945,15 +945,16 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
     uint32_t id = syntax->id;
     uint64_t length;
     int res;
-    void *newelem;
 
     data = (char *)data + syntax->data_offset;
     if (syntax->list_elem_size) {
         EbmlList *list = data;
-        newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
+        if ((res = av_reallocp_array(&list->elem,
-        if (!newelem)
+                                     list->nb_elem + 1,
-            return AVERROR(ENOMEM);
+                                     syntax->list_elem_size)) < 0) {
-        list->elem = newelem;
+            list->nb_elem = 0;
+            return res;
+        }
         data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
         memset(data, 0, syntax->list_elem_size);
         list->nb_elem++;

libavformat/matroskaenc.c

@@ -302,14 +302,17 @@ static mkv_seekhead * mkv_start_seekhead(AVIOContext *pb, int64_t segment_offset
 static int mkv_add_seekhead_entry(mkv_seekhead *seekhead, unsigned int elementid, uint64_t filepos)
 {
     mkv_seekhead_entry *entries = seekhead->entries;
+    int err;
 
     // don't store more elements than we reserved space for
     if (seekhead->max_entries > 0 && seekhead->max_entries <= seekhead->num_entries)
         return -1;
 
-    entries = av_realloc(entries, (seekhead->num_entries + 1) * sizeof(mkv_seekhead_entry));
+    if ((err = av_reallocp_array(&entries, seekhead->num_entries + 1,
-    if (entries == NULL)
+                                 sizeof(*entries))) < 0) {
-        return AVERROR(ENOMEM);
+        seekhead->num_entries = 0;
+        return err;
+    }
 
     entries[seekhead->num_entries  ].elementid = elementid;
     entries[seekhead->num_entries++].segmentpos = filepos - seekhead->segment_offset;
@@ -384,13 +387,16 @@ static mkv_cues * mkv_start_cues(int64_t segment_offset)
 static int mkv_add_cuepoint(mkv_cues *cues, int stream, int64_t ts, int64_t cluster_pos, int64_t relative_pos)
 {
     mkv_cuepoint *entries = cues->entries;
+    int err;
 
     if (ts < 0)
         return 0;
 
-    entries = av_realloc(entries, (cues->num_entries + 1) * sizeof(mkv_cuepoint));
+    if ((err = av_reallocp_array(&entries, cues->num_entries + 1,
-    if (entries == NULL)
+                                 sizeof(*entries))) < 0) {
-        return AVERROR(ENOMEM);
+        cues->num_entries = 0;
+        return err;
+    }
 
     entries[cues->num_entries  ].pts = ts;
     entries[cues->num_entries  ].tracknum = stream + 1;

libavformat/mov.c

@@ -2062,7 +2062,6 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
     unsigned int stps_index = 0;
     unsigned int i, j;
     uint64_t stream_size = 0;
-    AVIndexEntry *mem;
 
     /* adjust first dts according to edit list */
     if ((sc->empty_duration || sc->start_time) && mov->time_scale > 0) {
@@ -2097,10 +2096,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
             return;
         if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
             return;
-        mem = av_realloc(st->index_entries, (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries));
+        if (av_reallocp_array(&st->index_entries,
-        if (!mem)
+                              st->nb_index_entries + sc->sample_count,
+                              sizeof(*st->index_entries)) < 0) {
+            st->nb_index_entries = 0;
             return;
-        st->index_entries = mem;
+        }
         st->index_entries_allocated_size = (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries);
 
         for (i = 0; i < sc->chunk_count; i++) {
@@ -2207,10 +2208,12 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
         av_dlog(mov->fc, "chunk count %d\n", total);
         if (total >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
             return;
-        mem = av_realloc(st->index_entries, (st->nb_index_entries + total) * sizeof(*st->index_entries));
+        if (av_reallocp_array(&st->index_entries,
-        if (!mem)
+                              st->nb_index_entries + total,
+                              sizeof(*st->index_entries)) < 0) {
+            st->nb_index_entries = 0;
             return;
-        st->index_entries = mem;
+        }
         st->index_entries_allocated_size = (st->nb_index_entries + total) * sizeof(*st->index_entries);
 
         // populate index
@@ -2581,16 +2584,18 @@ static int mov_read_chap(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 static int mov_read_trex(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
     MOVTrackExt *trex;
+    int err;
 
     if ((uint64_t)c->trex_count+1 >= UINT_MAX / sizeof(*c->trex_data))
         return AVERROR_INVALIDDATA;
-    trex = av_realloc(c->trex_data, (c->trex_count+1)*sizeof(*c->trex_data));
+    if ((err = av_reallocp_array(&c->trex_data, c->trex_count + 1,
-    if (!trex)
+                                 sizeof(*c->trex_data))) < 0) {
-        return AVERROR(ENOMEM);
+        c->trex_count = 0;
+        return err;
+    }
 
     c->fc->duration = AV_NOPTS_VALUE; // the duration from mvhd is not representing the whole file when fragments are used.
 
-    c->trex_data = trex;
     trex = &c->trex_data[c->trex_count++];
     avio_r8(pb); /* version */
     avio_rb24(pb); /* flags */
@@ -2612,7 +2617,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     int64_t dts;
     int data_offset = 0;
     unsigned entries, first_sample_flags = frag->flags;
-    int flags, distance, i, found_keyframe = 0;
+    int flags, distance, i, found_keyframe = 0, err;
 
     for (i = 0; i < c->fc->nb_streams; i++) {
         if (c->fc->streams[i]->id == frag->track_id) {
@@ -2650,12 +2655,11 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     }
     if ((uint64_t)entries+sc->ctts_count >= UINT_MAX/sizeof(*sc->ctts_data))
         return AVERROR_INVALIDDATA;
-    ctts_data = av_realloc(sc->ctts_data,
+    if ((err = av_reallocp_array(&sc->ctts_data, entries + sc->ctts_count,
-                           (entries+sc->ctts_count)*sizeof(*sc->ctts_data));
+                                 sizeof(*sc->ctts_data))) < 0) {
-    if (!ctts_data)
+        sc->ctts_count = 0;
-        return AVERROR(ENOMEM);
+        return err;
-    sc->ctts_data = ctts_data;
+    }
-
     if (flags & MOV_TRUN_DATA_OFFSET)        data_offset        = avio_rb32(pb);
     if (flags & MOV_TRUN_FIRST_SAMPLE_FLAGS) first_sample_flags = avio_rb32(pb);
     dts    = sc->track_end - sc->time_offset;

libavformat/mpegts.c

@@ -238,10 +238,10 @@ static void clear_programs(MpegTSContext *ts)
 static void add_pat_entry(MpegTSContext *ts, unsigned int programid)
 {
     struct Program *p;
-    void *tmp = av_realloc(ts->prg, (ts->nb_prg+1)*sizeof(struct Program));
+    if (av_reallocp_array(&ts->prg, ts->nb_prg + 1, sizeof(*ts->prg)) < 0) {
-    if(!tmp)
+        ts->nb_prg = 0;
         return;
-    ts->prg = tmp;
+    }
     p = &ts->prg[ts->nb_prg];
     p->id = programid;
     p->nb_pids = 0;

libavformat/mxfdec.c

@@ -428,18 +428,20 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U
 static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
 {
     MXFContext *mxf = arg;
-    MXFPartition *partition, *tmp_part;
+    MXFPartition *partition;
     UID op;
     uint64_t footer_partition;
     uint32_t nb_essence_containers;
+    int err;
 
     if (mxf->partitions_count+1 >= UINT_MAX / sizeof(*mxf->partitions))
         return AVERROR(ENOMEM);
 
-    tmp_part = av_realloc(mxf->partitions, (mxf->partitions_count + 1) * sizeof(*mxf->partitions));
+    if ((err = av_reallocp_array(&mxf->partitions, mxf->partitions_count + 1,
-    if (!tmp_part)
+                                 sizeof(*mxf->partitions))) < 0) {
-        return AVERROR(ENOMEM);
+        mxf->partitions_count = 0;
-    mxf->partitions = tmp_part;
+        return err;
+    }
 
     if (mxf->parsing_backward) {
         /* insert the new partition pack in the middle
@@ -562,13 +564,15 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
 
 static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set)
 {
-    MXFMetadataSet **tmp;
+    int err;
+
     if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets))
         return AVERROR(ENOMEM);
-    tmp = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets));
+    if ((err = av_reallocp_array(&mxf->metadata_sets, mxf->metadata_sets_count + 1,
-    if (!tmp)
+                                 sizeof(*mxf->metadata_sets))) < 0) {
-        return AVERROR(ENOMEM);
+        mxf->metadata_sets_count = 0;
-    mxf->metadata_sets = tmp;
+        return err;
+    }
     mxf->metadata_sets[mxf->metadata_sets_count] = metadata_set;
     mxf->metadata_sets_count++;
     return 0;

libavformat/oggdec.c

@@ -88,7 +88,7 @@ static int ogg_restore(AVFormatContext *s, int discard)
     struct ogg *ogg = s->priv_data;
     AVIOContext *bc = s->pb;
     struct ogg_state *ost = ogg->state;
-    int i;
+    int i, err;
 
     if (!ost)
         return 0;
@@ -96,7 +96,6 @@ static int ogg_restore(AVFormatContext *s, int discard)
     ogg->state = ost->next;
 
     if (!discard) {
-        struct ogg_stream *old_streams = ogg->streams;
 
         for (i = 0; i < ogg->nstreams; i++)
             av_free(ogg->streams[i].buf);
@@ -105,16 +104,13 @@ static int ogg_restore(AVFormatContext *s, int discard)
         ogg->page_pos = -1;
         ogg->curidx   = ost->curidx;
         ogg->nstreams = ost->nstreams;
-        ogg->streams  = av_realloc(ogg->streams,
+        if ((err = av_reallocp_array(&ogg->streams, ogg->nstreams,
-                                   ogg->nstreams * sizeof(*ogg->streams));
+                                     sizeof(*ogg->streams))) < 0) {
-
+            ogg->nstreams = 0;
-        if (ogg->streams) {
+            return err;
+        } else
             memcpy(ogg->streams, ost->streams,
                    ost->nstreams * sizeof(*ogg->streams));
-        } else {
-            av_free(old_streams);
-            ogg->nstreams = 0;
-        }
     }
 
     av_free(ost);

libavformat/utils.c

@@ -3296,14 +3296,11 @@ AVStream *avformat_new_stream(AVFormatContext *s, const AVCodec *c)
 {
     AVStream *st;
     int i;
-    AVStream **streams;
 
-    if (s->nb_streams >= INT_MAX/sizeof(*streams))
+    if (av_reallocp_array(&s->streams, s->nb_streams + 1, sizeof(*s->streams)) < 0) {
+        s->nb_streams = 0;
         return NULL;
-    streams = av_realloc(s->streams, (s->nb_streams + 1) * sizeof(*streams));
+    }
-    if (!streams)
-        return NULL;
-    s->streams = streams;
 
     st = av_mallocz(sizeof(AVStream));
     if (!st)
@@ -3407,7 +3404,6 @@ void ff_program_add_stream_index(AVFormatContext *ac, int progid, unsigned int i
 {
     int i, j;
     AVProgram *program=NULL;
-    void *tmp;
 
     if (idx >= ac->nb_streams) {
         av_log(ac, AV_LOG_ERROR, "stream index %d is not valid\n", idx);
@@ -3422,10 +3418,12 @@ void ff_program_add_stream_index(AVFormatContext *ac, int progid, unsigned int i
             if(program->stream_index[j] == idx)
                 return;
 
-        tmp = av_realloc(program->stream_index, sizeof(unsigned int)*(program->nb_stream_indexes+1));
+        if (av_reallocp_array(&program->stream_index,
-        if(!tmp)
+                              program->nb_stream_indexes + 1,
+                              sizeof(*program->stream_index)) < 0) {
+            program->nb_stream_indexes = 0;
             return;
-        program->stream_index = tmp;
+        }
         program->stream_index[program->nb_stream_indexes++] = idx;
         return;
     }