Mercurial > mplayer.hg

comparison libmpdemux/demux_mkv.c @ 35341:34c05e3ea263

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix leaks in case of overflow.
author upsuper
date Wed, 21 Nov 2012 11:15:38 +0000
parents 9120eb514454
children 139f2b064ef9
comparison
equal deleted inserted replaced
35340:d5476d0811f8 35341:34c05e3ea263
1544 src = (uint8_t *) track->private_data + RVPROPERTIES_SIZE; 1544 src = (uint8_t *) track->private_data + RVPROPERTIES_SIZE;
1545 1545
1546 cnt = track->private_size - RVPROPERTIES_SIZE; 1546 cnt = track->private_size - RVPROPERTIES_SIZE;
1547 if (cnt > INT_MAX - sizeof(*bih) - 8) { 1547 if (cnt > INT_MAX - sizeof(*bih) - 8) {
1548 mp_msg(MSGT_DEMUX, MSGL_ERR, "[mkv] Integer overflow!\n"); 1548 mp_msg(MSGT_DEMUX, MSGL_ERR, "[mkv] Integer overflow!\n");
1549 free(bih);
1549 return 1; 1550 return 1;
1550 } 1551 }
1551 bih = realloc(bih, sizeof(*bih) + 8 + cnt); 1552 bih = realloc(bih, sizeof(*bih) + 8 + cnt);
1552 bih->biSize = 48 + cnt; 1553 bih->biSize = 48 + cnt;
1553 bih->biPlanes = 1; 1554 bih->biPlanes = 1;