protect realloc overflow

Originally committed as revision 18088 to svn://svn.ffmpeg.org/ffmpeg/trunk
16 years ago · b4800b8b7d
parent b9b4fc5e07
commit b4800b8b7d
1 changed files with 2 additions and 0 deletions
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@ -364,6 +364,8 @@ static int mxf_read_primer_pack(MXFContext *mxf)

 static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set)
 {
+    if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets))
+        return AVERROR(ENOMEM);
    mxf->metadata_sets = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets));
    if (!mxf->metadata_sets)
        return -1;