On Fri, Dec 17, 2021 at 11:15:06PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/ass.c | 32 ++++++++++++++++++++++++++------
> >  libavcodec/ass.h |  7 +++++++
> >  2 files changed, 33 insertions(+), 6 deletions(-)
> > 
> > diff --git a/libavcodec/ass.c b/libavcodec/ass.c
> > index 725e4d42ba1..d0a4d678bb4 100644
> > --- a/libavcodec/ass.c
> > +++ b/libavcodec/ass.c
> > @@ -114,17 +114,30 @@ char *ff_ass_get_dialog(int readorder, int layer, const char *style,
> >                         speaker ? speaker : "", text);
> >  }
> >  
> > -int ff_ass_add_rect(AVSubtitle *sub, const char *dialog,
> > +int ff_ass_add_rect2(AVSubtitle *sub, const char *dialog,
> >                      int readorder, int layer, const char *style,
> > -                    const char *speaker)
> > +                    const char *speaker, size_t *nb_rect_allocated)
> >  {
> > -    AVSubtitleRect **rects, *rect;
> > +    AVSubtitleRect **rects = sub->rects, *rect;
> >      char *ass_str;
> > +    uint64_t new_nb = 0;
> >  
> > -    rects = av_realloc_array(sub->rects, sub->num_rects+1, sizeof(*sub->rects));
> > -    if (!rects)
> > +    if (nb_rect_allocated && *nb_rect_allocated <= sub->num_rects) {
> > +        new_nb = sub->num_rects + sub->num_rects/16LL + 1;
> > +    } else if (!nb_rect_allocated)
> > +        new_nb = sub->num_rects + 1LL;
> > +    if (new_nb > SIZE_MAX)
> >          return AVERROR(ENOMEM);
> 
> AVSubtitle.num_rects is unsigned, so this number should always be
> bounded by UINT_MAX (and nb_rect_allocated can be a pointer to unsigned,
> too).

i had that initially but then wanted to move to better types but missed
this, changed it back locally

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Asymptotically faster algorithms should always be preferred if you have
asymptotical amounts of data