Commit 2620df13 authored by Martin Storsjö's avatar Martin Storsjö

mov: Free an earlier allocated array if allocating a new one

It could probably also be considered an error if the pointer isn't
null at this point, but then we might risk rejecting some
slightly broken files that we might have handled so far.

Sample-Id: 00000496-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: 's avatarMartin Storsjö <martin@martin.st>
parent d51f0996
...@@ -1717,6 +1717,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -1717,6 +1717,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (entries >= UINT_MAX / sizeof(*sc->stts_data)) if (entries >= UINT_MAX / sizeof(*sc->stts_data))
return AVERROR(EINVAL); return AVERROR(EINVAL);
av_free(sc->stts_data);
sc->stts_data = av_malloc(entries * sizeof(*sc->stts_data)); sc->stts_data = av_malloc(entries * sizeof(*sc->stts_data));
if (!sc->stts_data) if (!sc->stts_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment