Merge commit 'da7e31a240f276836a0b90ca6c0714181b353cc4'

* commit 'da7e31a240f276836a0b90ca6c0714181b353cc4':
  rmdec: Check memory allocations from ff_rm_alloc_rmstream()

Merged-by: Michael Niedermayer <michaelni@gmx.at>

2 files changed, 8 insertions, 0 deletions

diff --git a/libavformat/rdt.c b/libavformat/rdt.c
index 212e139f31..e799770fe2 100644
--- a/libavformat/rdt.c
+++ b/libavformat/rdt.c
@@ -434,6 +434,8 @@ rdt_parse_sdp_line (AVFormatContext *s, int st_index,
                     rdt->nb_rmst = count;
                 }
                 rdt->rmst[s->streams[n]->index] = ff_rm_alloc_rmstream();
+                if (!rdt->rmst[s->streams[n]->index])
+                    return AVERROR(ENOMEM);
                 rdt_load_mdpr(rdt, s->streams[n], (n - first) * 2);
            }
     }
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index c0afa7fb6f..9468d9764f 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -112,6 +112,8 @@ static void rm_read_metadata(AVFormatContext *s, AVIOContext *pb, int wide)
 RMStream *ff_rm_alloc_rmstream (void)
 {
     RMStream *rms = av_mallocz(sizeof(RMStream));
+    if (!rms)
+        return NULL;
     rms->curpic_num = -1;
     return rms;
 }
@@ -493,6 +495,8 @@ static int rm_read_header_old(AVFormatContext *s)
     if (!st)
         return -1;
     st->priv_data = ff_rm_alloc_rmstream();
+    if (!st->priv_data)
+        return AVERROR(ENOMEM);
     return rm_read_audio_stream_info(s, s->pb, st, st->priv_data, 1);
 }
 
@@ -576,6 +580,8 @@ static int rm_read_header(AVFormatContext *s)
             get_str8(pb, mime, sizeof(mime)); /* mimetype */
             st->codec->codec_type = AVMEDIA_TYPE_DATA;
             st->priv_data = ff_rm_alloc_rmstream();
+            if (!st->priv_data)
+                return AVERROR(ENOMEM);
             if (ff_rm_read_mdpr_codecdata(s, s->pb, st, st->priv_data,
                                           avio_rb32(pb), mime) < 0)
                 goto fail;