[FFmpeg-cvslog] r18088 - trunk/libavformat/mxfdec.c

[bcoudurier]

Author: bcoudurier
Date: Sat Mar 21 01:50:51 2009
New Revision: 18088

Log:
protect realloc overflow

Modified:
   trunk/libavformat/mxfdec.c

Modified: trunk/libavformat/mxfdec.c
==============================================================================
--- trunk/libavformat/mxfdec.c	Sat Mar 21 01:50:19 2009	(r18087)
+++ trunk/libavformat/mxfdec.c	Sat Mar 21 01:50:51 2009	(r18088)
@@ -364,6 +364,8 @@ static int mxf_read_primer_pack(MXFConte
 
 static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set)
 {
+    if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets))
+        return AVERROR(ENOMEM);
     mxf->metadata_sets = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets));
     if (!mxf->metadata_sets)
         return -1;