[MPlayer-cvslog] r29736 - trunk/libmpdemux/demux_mkv.c

[reimar]

Author: reimar
Date: Wed Sep 30 09:41:00 2009
New Revision: 29736

Log:
Check for integer overflow in grow_array.

Modified:
   trunk/libmpdemux/demux_mkv.c

Modified: trunk/libmpdemux/demux_mkv.c
==============================================================================
--- trunk/libmpdemux/demux_mkv.c	Wed Sep 30 09:35:33 2009	(r29735)
+++ trunk/libmpdemux/demux_mkv.c	Wed Sep 30 09:41:00 2009	(r29736)
@@ -213,7 +213,10 @@ static void grow_array(void *arrayp, int
   void *oldp = *array;
   if (nelem & 31)
     return;
-  *array = realloc(*array, (nelem + 32) * elsize);
+  if (nelem > UINT_MAX / elsize - 32)
+    *array = NULL;
+  else
+    *array = realloc(*array, (nelem + 32) * elsize);
   if (!*array)
     free(oldp);
 }