From 6e07bb36393f03d16b792738196ae045fc24acb6 Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Mon, 9 Sep 2013 11:28:54 +0000
Subject: [PATCH] avcodec/truemotion2: use av_reallocp_array() and check return
 value

Also reset tok_lens if reallocation fails.

Fixes #2946.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/truemotion2.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c
index 9d96039f0f..840b993d0d 100644
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -342,7 +342,11 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
         tm2_free_codes(&codes);
         return AVERROR_INVALIDDATA;
     }
-    ctx->tokens[stream_id]   = av_realloc(ctx->tokens[stream_id], toks * sizeof(int));
+    ret = av_reallocp_array(&ctx->tokens[stream_id], toks, sizeof(int));
+    if (ret < 0) {
+        ctx->tok_lens[stream_id] = 0;
+        return ret;
+    }
     ctx->tok_lens[stream_id] = toks;
     len = bytestream2_get_be32(&gb);
     if (len > 0) {