diff options
| author | Chris Miceli <chris@miceli.net.au> | 2020-10-13 14:22:25 +1100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-14 21:11:49 +0200 |
| commit | 0c90377a402d10279a4133034d8dd66c1809d42c (patch) | |
| tree | e767e7c0ef6069d58fd4fe4bbf42da7422546055 /libavformat/avidec.c | |
| parent | 6bdfea8d4b3683605f47994e491770bc0bc6ce5d (diff) | |
libavformat/avidec: check memory allocation
Memory allocation for AVIOContext should be checked. In this code,
all error conditions are sent to the "goto error".
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/avidec.c')
| -rw-r--r-- | libavformat/avidec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 9765e5e7b2..33e50e9878 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1072,11 +1072,15 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt) ff_const59 AVInputFormat *sub_demuxer; AVRational time_base; int size; + AVProbeData pd; + unsigned int desc_len; AVIOContext *pb = avio_alloc_context(pkt->data + 7, pkt->size - 7, 0, NULL, NULL, NULL, NULL); - AVProbeData pd; - unsigned int desc_len = avio_rl32(pb); + if (!pb) + goto error; + + desc_len = avio_rl32(pb); if (desc_len > pb->buf_end - pb->buf_ptr) goto error; |