diff options
author | wm4 <wm4@nowhere> | 2014-01-03 00:42:40 +0100 |
---|---|---|
committer | wm4 <wm4@nowhere> | 2014-01-06 20:21:37 +0100 |
commit | 89b854165e759d019ecf53d755f83eaecbf2d99c (patch) | |
tree | ae0347319c7144ef58415b59f88c05233db00288 | |
parent | 0beece4397c578912bd91b1b90dd4b2abcba58f8 (diff) | |
download | mpv-89b854165e759d019ecf53d755f83eaecbf2d99c.tar.bz2 mpv-89b854165e759d019ecf53d755f83eaecbf2d99c.tar.xz |
audio: check for overflows
-rw-r--r-- | audio/audio.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/audio/audio.c b/audio/audio.c index 950d25be75..e8ff96ddc3 100644 --- a/audio/audio.c +++ b/audio/audio.c @@ -15,6 +15,9 @@ * with mpv. If not, see <http://www.gnu.org/licenses/>. */ +#include <stdint.h> +#include <limits.h> +#include <stdlib.h> #include <assert.h> #include <libavutil/mem.h> @@ -145,6 +148,8 @@ static void mp_audio_destructor(void *ptr) void mp_audio_realloc(struct mp_audio *mpa, int samples) { assert(samples >= 0); + if (samples >= INT_MAX / mpa->sstride) + abort(); // oom int size = MPMAX(samples * mpa->sstride, 1); for (int n = 0; n < mpa->num_planes; n++) { if (size != mpa->allocated[n]) { |