Mercurial > mplayer.hg

changeset 29694:58b03e2d2ac2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Check for integer overflow in grow_array.
author reimar
date Wed, 30 Sep 2009 07:41:00 +0000
parents 328f17988caf
children 7eaa16c03a87
files libmpdemux/demux_mkv.c
diffstat 1 files changed, 4 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/libmpdemux/demux_mkv.c	Wed Sep 30 07:35:33 2009 +0000
+++ b/libmpdemux/demux_mkv.c	Wed Sep 30 07:41:00 2009 +0000
@@ -213,7 +213,10 @@
   void *oldp = *array;
   if (nelem & 31)
     return;
-  *array = realloc(*array, (nelem + 32) * elsize);
+  if (nelem > UINT_MAX / elsize - 32)
+    *array = NULL;
+  else
+    *array = realloc(*array, (nelem + 32) * elsize);
   if (!*array)
     free(oldp);
 }