From: Federico Tomassetti <[email protected]>
Bug-Id: CID 1257798 / CID 1257805
---
libavformat/oggdec.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 760cc25..0b63040 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -64,6 +64,8 @@ static int ogg_save(AVFormatContext *s)
struct ogg_state *ost =
av_malloc(sizeof(*ost) + (ogg->nstreams - 1) * sizeof(*ogg->streams));
int i;
+ if (!ost)
+ return AVERROR(ENOMEM);
ost->pos = avio_tell(s->pb);
ost->curidx = ogg->curidx;
ost->next = ogg->state;
@@ -72,7 +74,15 @@ static int ogg_save(AVFormatContext *s)
for (i = 0; i < ogg->nstreams; i++) {
struct ogg_stream *os = ogg->streams + i;
+ int j;
os->buf = av_mallocz(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
+ if (!os->buf) {
+ for (j = 0; j < i; j++) {
+ struct ogg_stream *os_j = ogg->streams + j;
+ av_freep(&os_j->buf);
+ }
+ return AVERROR(ENOMEM);
+ }
memcpy(os->buf, ost->streams[i].buf, os->bufpos);
}
@@ -191,6 +201,8 @@ static int ogg_new_buf(struct ogg *ogg, int idx)
struct ogg_stream *os = ogg->streams + idx;
uint8_t *nb = av_malloc(os->bufsize + FF_INPUT_BUFFER_PADDING_SIZE);
int size = os->bufpos - os->pstart;
+ if (!nb)
+ return AVERROR(ENOMEM);
if (os->buf) {
memcpy(nb, os->buf + os->pstart, size);
--
2.2.2
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
