diff options
author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2009-09-30 07:41:00 +0000 |
---|---|---|
committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2009-09-30 07:41:00 +0000 |
commit | eb5571e57e366d8a812e1f056a707045b0c67bd8 (patch) | |
tree | a61f065d42dcfd4d6cf5304145e772ecd788884e | |
parent | aa576e8fc00559eeed70baac935099eeb609d5ea (diff) | |
download | mpv-eb5571e57e366d8a812e1f056a707045b0c67bd8.tar.bz2 mpv-eb5571e57e366d8a812e1f056a707045b0c67bd8.tar.xz |
Check for integer overflow in grow_array.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@29736 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r-- | libmpdemux/demux_mkv.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libmpdemux/demux_mkv.c b/libmpdemux/demux_mkv.c index 21dc246f7f..0804dcf5bb 100644 --- a/libmpdemux/demux_mkv.c +++ b/libmpdemux/demux_mkv.c @@ -213,7 +213,10 @@ static void grow_array(void *arrayp, int nelem, size_t elsize) { void *oldp = *array; if (nelem & 31) return; - *array = realloc(*array, (nelem + 32) * elsize); + if (nelem > UINT_MAX / elsize - 32) + *array = NULL; + else + *array = realloc(*array, (nelem + 32) * elsize); if (!*array) free(oldp); } |