summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwm4 <wm4@nowhere>2014-01-03 00:42:40 +0100
committerwm4 <wm4@nowhere>2014-01-06 20:21:37 +0100
commit89b854165e759d019ecf53d755f83eaecbf2d99c (patch)
treeae0347319c7144ef58415b59f88c05233db00288
parent0beece4397c578912bd91b1b90dd4b2abcba58f8 (diff)
downloadmpv-89b854165e759d019ecf53d755f83eaecbf2d99c.tar.bz2
mpv-89b854165e759d019ecf53d755f83eaecbf2d99c.tar.xz
audio: check for overflows
-rw-r--r--audio/audio.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/audio/audio.c b/audio/audio.c
index 950d25be75..e8ff96ddc3 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -15,6 +15,9 @@
* with mpv. If not, see <http://www.gnu.org/licenses/>.
*/
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
#include <assert.h>
#include <libavutil/mem.h>
@@ -145,6 +148,8 @@ static void mp_audio_destructor(void *ptr)
void mp_audio_realloc(struct mp_audio *mpa, int samples)
{
assert(samples >= 0);
+ if (samples >= INT_MAX / mpa->sstride)
+ abort(); // oom
int size = MPMAX(samples * mpa->sstride, 1);
for (int n = 0; n < mpa->num_planes; n++) {
if (size != mpa->allocated[n]) {