diff options
Diffstat (limited to 'libavformat/rtpdec_asf.c')
| -rw-r--r-- | libavformat/rtpdec_asf.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c index 287025f377..9d8c87b889 100644 --- a/libavformat/rtpdec_asf.c +++ b/libavformat/rtpdec_asf.c @@ -233,8 +233,14 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf, int cur_len = start_off + len_off - off; int prev_len = out_len; + void *newmem; out_len += cur_len; - asf->buf = av_realloc(asf->buf, out_len); + if (FFMIN(cur_len, len - off) < 0) + return -1; + newmem = av_realloc(asf->buf, out_len); + if (!newmem) + return -1; + asf->buf = newmem; memcpy(asf->buf + prev_len, buf + off, FFMIN(cur_len, len - off)); avio_skip(pb, cur_len); |