diff options
author | rtogni <rtogni@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-06-04 22:41:27 +0000 |
---|---|---|
committer | rtogni <rtogni@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-06-04 22:41:27 +0000 |
commit | 9da93175794398fefeb45c6c53abdcdeda325101 (patch) | |
tree | 1dad782a7785b845d9bfc950631e91c01369154b /libmpdemux/demux_viv.c | |
parent | b4ddc383ef4e4d537417999e390ab90631e7b6aa (diff) | |
download | mpv-9da93175794398fefeb45c6c53abdcdeda325101.tar.bz2 mpv-9da93175794398fefeb45c6c53abdcdeda325101.tar.xz |
Fix potential integer overflows in memory allocation.
Patch by Rich and me
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18559 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux/demux_viv.c')
-rw-r--r-- | libmpdemux/demux_viv.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libmpdemux/demux_viv.c b/libmpdemux/demux_viv.c index 3beaddf2aa..206e310d7c 100644 --- a/libmpdemux/demux_viv.c +++ b/libmpdemux/demux_viv.c @@ -387,6 +387,8 @@ static int demux_vivo_fill_buffer(demuxer_t *demux, demux_stream_t *dsds){ } else { // append data to it! demux_packet_t* dp=ds->asf_packet; + if(dp->len + len + FF_INPUT_BUFFER_PADDING_SIZE < 0) + return 0; dp->buffer=realloc(dp->buffer,dp->len+len+FF_INPUT_BUFFER_PADDING_SIZE); memset(dp->buffer+dp->len+len, 0, FF_INPUT_BUFFER_PADDING_SIZE); //memcpy(dp->buffer+dp->len,data,len); |