From patchwork Sat Nov 19 18:09:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Almer X-Patchwork-Id: 1489 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.90.1 with SMTP id o1csp749198vsb; Sat, 19 Nov 2016 10:09:49 -0800 (PST) X-Received: by 10.194.171.104 with SMTP id at8mr3560467wjc.159.1479578989536; Sat, 19 Nov 2016 10:09:49 -0800 (PST) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id go16si12610102wjc.76.2016.11.19.10.09.48; Sat, 19 Nov 2016 10:09:49 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 8FBF9689E11; Sat, 19 Nov 2016 20:09:44 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-qk0-f194.google.com (mail-qk0-f194.google.com [209.85.220.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 72EFA6898D3 for ; Sat, 19 Nov 2016 20:09:38 +0200 (EET) Received: by mail-qk0-f194.google.com with SMTP id x190so38907946qkb.0 for ; Sat, 19 Nov 2016 10:09:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:message-id; bh=vm9vo1BUi+c4oS+2SuoPNa3H9soTM52JDwOS2hjINac=; b=Xe6KLKN+cUye98dgU7PRYxLXva/DqmrAFP0CXiRJ0dlx+XO3brhjOwTt7NF6FnDO0p K5y9HdqImO7+gJpsHTj5pwBZavDfG+lS6vjBuBmB9rGzZOupyUo8dPdZ3QFe6ky8JsK4 PPG/G47g/IiFO2sBinCOQ4NcIcHMScON02ApWYepXIPwWVS9ntWXpIYZqj+Gtk+4wITv 93t5B7Mv72fliWs752wvMvLd7qf0qQuYuFuCdIG8gKKK8MDtBBesVpw7kyoZNo/6d7jm vzxjgriGvuEIX2T2d5nxl7GkUN5YjyvpuwSukGTSGaWwe4fmLHSKlMBZxpmrzxhvVbTO xQfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id; bh=vm9vo1BUi+c4oS+2SuoPNa3H9soTM52JDwOS2hjINac=; b=T7dXMh16zz8wIQUOp7LpVN1B4OLrAXVG+HZFMKkEeWR+RtIIP8k3IVbF+9uExmNqIO sBb2mPpFOGBZ/0QXQNgYj6Y2336X1GxkyLyEloI+/V1nMPNShxSktY0po9S9GsVOqUz3 CeJXsgKYXQ8Nd+zxXInzIqEzPA0gP/TLzDkh5u9KtNG9wIu6miTBz55JWOe7/9ik3Mpq M3T8SCW7ULE7X38gf9xee91WqCQQw2ikA4fDBjSs+iJPNfqLiIaH+z7Il8QUVprE0QW5 sS6A+wTvumVMFeUkOAFrwKmThOKlMqTeVv0vJ6IPDMtXrYyh9J52ao/Kqr2/g8aBCogf BVhg== X-Gm-Message-State: AKaTC00Nabr3SMdUQ5to6OruoxsVbOCAcHivQLrvdDebgdqGa/Bux2mcy4Un1Pq9X0d1/w== X-Received: by 10.233.221.130 with SMTP id r124mr6812329qkf.183.1479578979508; Sat, 19 Nov 2016 10:09:39 -0800 (PST) Received: from localhost.localdomain ([181.22.0.199]) by smtp.gmail.com with ESMTPSA id a69sm6940047qkj.38.2016.11.19.10.09.38 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 19 Nov 2016 10:09:39 -0800 (PST) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Sat, 19 Nov 2016 15:09:15 -0300 Message-Id: <20161119180915.7056-1-jamrial@gmail.com> X-Mailer: git-send-email 2.10.1 Subject: [FFmpeg-devel] [PATCH] avformat/utils: check for overflow before reallocating side data X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" This makes av_stream_add_side_data() consistent with av_packet_add_side_data(). Signed-off-by: James Almer --- libavformat/utils.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index 19bb8bd..9d01bab 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -5121,7 +5121,10 @@ int av_stream_add_side_data(AVStream *st, enum AVPacketSideDataType type, } } - tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, sizeof(*tmp)); + if ((unsigned)st->nb_side_data + 1 >= INT_MAX / sizeof(*st->side_data)) + return AVERROR(ERANGE); + + tmp = av_realloc(st->side_data, st->nb_side_data + 1 * sizeof(*tmp)); if (!tmp) { return AVERROR(ENOMEM); }