diff options
| author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2009-09-30 07:41:00 +0000 |
|---|---|---|
| committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2009-09-30 07:41:00 +0000 |
| commit | eb5571e57e366d8a812e1f056a707045b0c67bd8 (patch) | |
| tree | a61f065d42dcfd4d6cf5304145e772ecd788884e /libmpdemux/demux_mkv.c | |
| parent | aa576e8fc00559eeed70baac935099eeb609d5ea (diff) | |
| download | mpv-eb5571e57e366d8a812e1f056a707045b0c67bd8.tar.bz2 mpv-eb5571e57e366d8a812e1f056a707045b0c67bd8.tar.xz | |
Check for integer overflow in grow_array.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@29736 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux/demux_mkv.c')
| -rw-r--r-- | libmpdemux/demux_mkv.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libmpdemux/demux_mkv.c b/libmpdemux/demux_mkv.c index 21dc246f7f..0804dcf5bb 100644 --- a/libmpdemux/demux_mkv.c +++ b/libmpdemux/demux_mkv.c @@ -213,7 +213,10 @@ static void grow_array(void *arrayp, int nelem, size_t elsize) { void *oldp = *array; if (nelem & 31) return; - *array = realloc(*array, (nelem + 32) * elsize); + if (nelem > UINT_MAX / elsize - 32) + *array = NULL; + else + *array = realloc(*array, (nelem + 32) * elsize); if (!*array) free(oldp); } |