[vlc-devel] commit: Protected against NULL realloc from unbounded size (faad). ( Laurent Aimar )

[git version control]

vlc | branch: master | Laurent Aimar <fenrir at videolan.org> | Tue Sep 29 23:26:59 2009 +0200| [7eadb126ddc6da488a96b48e015a03f9383753a1] | committer: Laurent Aimar 

Protected against NULL realloc from unbounded size (faad).

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=7eadb126ddc6da488a96b48e015a03f9383753a1
---

 modules/codec/faad.c |   13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/modules/codec/faad.c b/modules/codec/faad.c
index 84b77b9..6dbd499 100644
--- a/modules/codec/faad.c
+++ b/modules/codec/faad.c
@@ -232,8 +232,17 @@ static aout_buffer_t *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
     /* Append the block to the temporary buffer */
     if( p_sys->i_buffer_size < p_sys->i_buffer + p_block->i_buffer )
     {
-        p_sys->i_buffer_size = p_sys->i_buffer + p_block->i_buffer;
-        p_sys->p_buffer = realloc( p_sys->p_buffer, p_sys->i_buffer_size );
+        size_t  i_buffer_size = p_sys->i_buffer + p_block->i_buffer;
+        uint8_t *p_buffer     = realloc( p_sys->p_buffer, i_buffer_size );
+        if( p_buffer )
+        {
+            p_sys->i_buffer_size = i_buffer_size;
+            p_sys->p_buffer      = p_buffer;
+        }
+        else
+        {
+            p_block->i_buffer = 0;
+        }
     }
 
     if( p_block->i_buffer > 0 )