[vlc-commits] demux: nuv: fix unchecked realloc

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Dec 30 23:36:32 2015 +0100| [d58977883b3329497a32dbf2de4ed4a460f7fa64] | committer: Francois Cartegnie

demux: nuv: fix unchecked realloc

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=d58977883b3329497a32dbf2de4ed4a460f7fa64
---

 modules/demux/nuv.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/modules/demux/nuv.c b/modules/demux/nuv.c
index e0ee8a0..3fe9e72 100644
--- a/modules/demux/nuv.c
+++ b/modules/demux/nuv.c
@@ -32,6 +32,7 @@
 #include <vlc_common.h>
 #include <vlc_plugin.h>
 #include <vlc_demux.h>
+#include <limits.h>
 
 /* TODO:
  *  - test
@@ -921,9 +922,15 @@ static void demux_IndexAppend( demux_index_t *p_idx,
         }
         else
         {
+            if(INT_MAX - 1000 < p_idx->i_idx_max ||
+               (SIZE_MAX / sizeof(demux_index_entry_t)) - p_idx->i_idx_max < 1000)
+                return;
+            size_t i_realloc = (1000 + p_idx->i_idx_max) * sizeof(demux_index_entry_t);
+            demux_index_entry_t *p_realloc = realloc( p_idx->idx, i_realloc );
+            if( !p_realloc )
+                return;
             p_idx->i_idx_max += 1000;
-            p_idx->idx = xrealloc( p_idx->idx,
-                                p_idx->i_idx_max*sizeof(demux_index_entry_t));
+            p_idx->idx = p_realloc;
         }
     }