[FFmpeg-devel] [PATCH 5/5] avutil/frame: Use av_realloc_array(), improve overflow check

From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
To: ffmpeg-devel@ffmpeg.org
Cc: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Subject: [FFmpeg-devel] [PATCH 5/5] avutil/frame: Use av_realloc_array(), improve overflow check
Date: Fri, 22 Mar 2024 15:41:38 +0100
Message-ID: <GV1P250MB0737730CE97ED707D62BFFE68F312@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <GV1P250MB0737842CEA6E6DCA5F67FFB38F312@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM>

Also use sizeof of the proper type, namely sizeof(**sd)
and not sizeof(*sd).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavutil/frame.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavutil/frame.c b/libavutil/frame.c
index 7dd37e5490..d7a32cdc92 100644
--- a/libavutil/frame.c
+++ b/libavutil/frame.c
@@ -721,10 +721,11 @@ static AVFrameSideData *add_side_data_from_buf(AVFrameSideData ***sd,
     if (!buf)
         return NULL;
 
-    if (*nb_sd > INT_MAX / sizeof(*sd) - 1)
+    // *nb_sd + 1 needs to fit into an int and a size_t.
+    if ((unsigned)*nb_sd >= FFMIN(INT_MAX, SIZE_MAX))
         return NULL;
 
-    tmp = av_realloc(*sd, (*nb_sd + 1) * sizeof(*sd));
+    tmp = av_realloc_array(*sd, sizeof(**sd), *nb_sd + 1);
     if (!tmp)
         return NULL;
     *sd = tmp;
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
