From 52ed634811c67cb2fe3dee017df6fb1961c35668 Mon Sep 17 00:00:00 2001
From: wm4 <wm4@nowhere>
Date: Fri, 3 Jan 2014 00:42:40 +0100
Subject: audio: check for overflows

---
 audio/audio.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'audio/audio.c')

diff --git a/audio/audio.c b/audio/audio.c
index 950d25be75..e8ff96ddc3 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -15,6 +15,9 @@
  * with mpv.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
 #include <assert.h>
 
 #include <libavutil/mem.h>
@@ -145,6 +148,8 @@ static void mp_audio_destructor(void *ptr)
 void mp_audio_realloc(struct mp_audio *mpa, int samples)
 {
     assert(samples >= 0);
+    if (samples >= INT_MAX / mpa->sstride)
+        abort(); // oom
     int size = MPMAX(samples * mpa->sstride, 1);
     for (int n = 0; n < mpa->num_planes; n++) {
         if (size != mpa->allocated[n]) {
-- 
cgit v1.2.3