diff options
| author | wm4 <wm4@nowhere> | 2014-01-03 00:42:40 +0100 |
|---|---|---|
| committer | wm4 <wm4@nowhere> | 2014-01-03 00:42:40 +0100 |
| commit | 52ed634811c67cb2fe3dee017df6fb1961c35668 (patch) | |
| tree | 7ad3af343aecb70da2cc6e124ce83c06e47eccf1 /audio | |
| parent | 7ed4ce91e8a4f9979ac92391c74fcca1459863d7 (diff) | |
| download | mpv-52ed634811c67cb2fe3dee017df6fb1961c35668.tar.bz2 mpv-52ed634811c67cb2fe3dee017df6fb1961c35668.tar.xz | |
audio: check for overflows
Diffstat (limited to 'audio')
| -rw-r--r-- | audio/audio.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/audio/audio.c b/audio/audio.c index 950d25be75..e8ff96ddc3 100644 --- a/audio/audio.c +++ b/audio/audio.c @@ -15,6 +15,9 @@ * with mpv. If not, see <http://www.gnu.org/licenses/>. */ +#include <stdint.h> +#include <limits.h> +#include <stdlib.h> #include <assert.h> #include <libavutil/mem.h> @@ -145,6 +148,8 @@ static void mp_audio_destructor(void *ptr) void mp_audio_realloc(struct mp_audio *mpa, int samples) { assert(samples >= 0); + if (samples >= INT_MAX / mpa->sstride) + abort(); // oom int size = MPMAX(samples * mpa->sstride, 1); for (int n = 0; n < mpa->num_planes; n++) { if (size != mpa->allocated[n]) { |