On 22/11/2016 23:16, Vittorio Giovara wrote:
> -    tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, 
> sizeof(*tmp));
> +    if ((unsigned) st->nb_side_data + 1 >= INT_MAX / sizeof(*st->side_data))
> +        return AVERROR(ERANGE);
> +
> +    tmp = av_realloc(st->side_data, (st->nb_side_data + 1) * sizeof(*tmp));

Why that?
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to