Message ID | 20210222093234.212078-3-andreas.rheinhardt@gmail.com |
---|---|
State | Accepted |
Commit | 963d4b76debd3b7577a8e35fb40662974d52fe28 |
Headers | show |
Series | [FFmpeg-devel,1/3] avformat/wavenc: Fix leak and segfault on reallocation error | expand |
Context | Check | Description |
---|---|---|
andriy/x86_make | success | Make finished |
andriy/x86_make_fate | success | Make fate finished |
andriy/PPC64_make | success | Make finished |
andriy/PPC64_make_fate | success | Make fate finished |
diff --git a/libavformat/concat.c b/libavformat/concat.c index 418405dd50..278afd997d 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -73,14 +73,11 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) for (i = 0, len = 1; uri[i]; i++) { if (uri[i] == *AV_CAT_SEPARATOR) { - /* integer overflow */ - if (++len == UINT_MAX / sizeof(*nodes)) { - return AVERROR(ENAMETOOLONG); - } + len++; } } - if (!(nodes = av_realloc(NULL, sizeof(*nodes) * len))) + if (!(nodes = av_realloc_array(NULL, len, sizeof(*nodes)))) return AVERROR(ENOMEM); else data->nodes = nodes;
This code was written when the allocation functions used parameters of type unsigned. This is no longer true today and therefore we only need to check whether the multiplication of the array's size stays within a size_t -- and this can be offloaded to av_realloc_array. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> --- libavformat/concat.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)