[FFmpeg-cvslog] avcodec/av1_parse: Use av_fast_realloc() for OBU array

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Mon Oct 14 23:42:01 2019 -0300| [62f47225825ce0827570eb2c12033303d121e4ef] | committer: James Almer

avcodec/av1_parse: Use av_fast_realloc() for OBU array

Based on commits 22bec0d33f4231487547581a1f77e2e8e6eade88 and
cebb446911fdc6c42d5a480b441b025c399e4a88.

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=62f47225825ce0827570eb2c12033303d121e4ef
---

 libavcodec/av1_parse.c | 8 ++++++--
 libavcodec/av1_parse.h | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavcodec/av1_parse.c b/libavcodec/av1_parse.c
index 6742bc152d..59ea0bc6e7 100644
--- a/libavcodec/av1_parse.c
+++ b/libavcodec/av1_parse.c
@@ -66,7 +66,11 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 
         if (pkt->obus_allocated < pkt->nb_obus + 1) {
             int new_size = pkt->obus_allocated + 1;
-            AV1OBU *tmp = av_realloc_array(pkt->obus, new_size, sizeof(*tmp));
+            AV1OBU *tmp;
+
+            if (new_size >= INT_MAX / sizeof(*tmp))
+                return AVERROR(ENOMEM);
+            tmp = av_fast_realloc(pkt->obus, &pkt->obus_allocated_size, new_size * sizeof(*tmp));
             if (!tmp)
                 return AVERROR(ENOMEM);
 
@@ -102,5 +106,5 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 void ff_av1_packet_uninit(AV1Packet *pkt)
 {
     av_freep(&pkt->obus);
-    pkt->obus_allocated = 0;
+    pkt->obus_allocated = pkt->obus_allocated_size = 0;
 }
diff --git a/libavcodec/av1_parse.h b/libavcodec/av1_parse.h
index 864308f81d..f3d932bc55 100644
--- a/libavcodec/av1_parse.h
+++ b/libavcodec/av1_parse.h
@@ -56,6 +56,7 @@ typedef struct AV1Packet {
     AV1OBU *obus;
     int nb_obus;
     int obus_allocated;
+    unsigned obus_allocated_size;
 } AV1Packet;
 
 /**