|
|
|
@@ -110,6 +110,7 @@ typedef const struct EbmlSyntax { |
|
|
|
|
|
|
|
typedef struct EbmlList { |
|
|
|
int nb_elem; |
|
|
|
unsigned int alloc_elem_size; |
|
|
|
void *elem; |
|
|
|
} EbmlList; |
|
|
|
|
|
|
|
@@ -1236,8 +1237,13 @@ static int ebml_parse(MatroskaDemuxContext *matroska, |
|
|
|
data = (char *) data + syntax->data_offset; |
|
|
|
if (syntax->list_elem_size) { |
|
|
|
EbmlList *list = data; |
|
|
|
void *newelem = av_realloc_array(list->elem, list->nb_elem + 1, |
|
|
|
syntax->list_elem_size); |
|
|
|
void *newelem; |
|
|
|
|
|
|
|
if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size) |
|
|
|
return AVERROR(ENOMEM); |
|
|
|
newelem = av_fast_realloc(list->elem, |
|
|
|
&list->alloc_elem_size, |
|
|
|
(list->nb_elem + 1) * syntax->list_elem_size); |
|
|
|
if (!newelem) |
|
|
|
return AVERROR(ENOMEM); |
|
|
|
list->elem = newelem; |
|
|
|
@@ -1490,6 +1496,7 @@ static void ebml_free(EbmlSyntax *syntax, void *data) |
|
|
|
ebml_free(syntax[i].def.n, ptr); |
|
|
|
av_freep(&list->elem); |
|
|
|
list->nb_elem = 0; |
|
|
|
list->alloc_elem_size = 0; |
|
|
|
} else |
|
|
|
ebml_free(syntax[i].def.n, data_off); |
|
|
|
default: |
|
|
|
|