Commit ba064ebe authored by Luca Barbato's avatar Luca Barbato

oggdec: check memory allocation

parent f5f1cf52
...@@ -160,8 +160,13 @@ static int ogg_new_stream(AVFormatContext *s, uint32_t serial, int new_avstream) ...@@ -160,8 +160,13 @@ static int ogg_new_stream(AVFormatContext *s, uint32_t serial, int new_avstream)
AVStream *st; AVStream *st;
struct ogg_stream *os; struct ogg_stream *os;
ogg->streams = av_realloc(ogg->streams, os = av_realloc(ogg->streams, ogg->nstreams * sizeof(*ogg->streams));
ogg->nstreams * sizeof(*ogg->streams));
if (!os)
return AVERROR(ENOMEM);
ogg->streams = os;
memset(ogg->streams + idx, 0, sizeof(*ogg->streams)); memset(ogg->streams + idx, 0, sizeof(*ogg->streams));
os = ogg->streams + idx; os = ogg->streams + idx;
...@@ -305,6 +310,8 @@ static int ogg_read_page(AVFormatContext *s, int *str) ...@@ -305,6 +310,8 @@ static int ogg_read_page(AVFormatContext *s, int *str)
if (os->bufsize - os->bufpos < size) { if (os->bufsize - os->bufpos < size) {
uint8_t *nb = av_malloc((os->bufsize *= 2) + FF_INPUT_BUFFER_PADDING_SIZE); uint8_t *nb = av_malloc((os->bufsize *= 2) + FF_INPUT_BUFFER_PADDING_SIZE);
if (!nb)
return AVERROR(ENOMEM);
memcpy(nb, os->buf, os->bufpos); memcpy(nb, os->buf, os->bufpos);
av_free(os->buf); av_free(os->buf);
os->buf = nb; os->buf = nb;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment