# HG changeset patch
# User mru
# Date 1250719180 0
# Node ID 685af2860d80babec674373dbf7f98d657b6810e
# Parent  3fca809be8ed38a2356548011706f0f0b60eae98
eval: replace variable-length array with av_malloc/free

There is a theoretical possibility to pass a very long string to ff_parse,
which could crash if allocated from the stack.  This allows the allocation
to be checked properly.

diff -r 3fca809be8ed -r 685af2860d80 eval.c
--- a/eval.c	Wed Aug 19 21:59:36 2009 +0000
+++ b/eval.c	Wed Aug 19 21:59:40 2009 +0000
@@ -369,8 +369,12 @@
                double (**func2)(void *, double, double), const char **func2_name,
                const char **error){
     Parser p;
-    AVEvalExpr * e;
-    char w[strlen(s) + 1], * wp = w;
+    AVEvalExpr *e = NULL;
+    char *w = av_malloc(strlen(s) + 1);
+    char *wp = w;
+
+    if (!w)
+        goto end;
 
     while (*s)
         if (!isspace(*s++)) *wp++ = s[-1];
@@ -388,8 +392,10 @@
     e = parse_expr(&p);
     if (!verify_expr(e)) {
         ff_eval_free(e);
-        return NULL;
+        e = NULL;
     }
+end:
+    av_free(w);
     return e;
 }