RepoMirrors/mpv
1
0
Fork 0
mirror of https://github.com/mpv-player/mpv synced 2025-04-11 04:01:31 +00:00
Code Issues Releases Wiki Activity

Check for integer overflow in grow_array.

Browse Source 
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@29736 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
reimar 2009-09-30 07:41:00 +00:00
parent aa576e8fc0
commit eb5571e57e
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libmpdemux/demux_mkv.c
View File

@ -213,7 +213,10 @@ static void grow_array(void *arrayp, int nelem, size_t elsize) {
void *oldp = *array; void *oldp = *array;
if (nelem & 31) if (nelem & 31)
return; return;
*array = realloc(*array, (nelem + 32) * elsize); if (nelem > UINT_MAX / elsize - 32)
*array = NULL;
else
*array = realloc(*array, (nelem + 32) * elsize);
if (!*array) if (!*array)
free(oldp); free(oldp);
} }