ebml_read_binary: use fast_padded_malloc()
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Nov 2012 21:58:10 +0000 (22:58 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Nov 2012 22:35:58 +0000 (23:35 +0100)
Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c

index ba53e34..ec279ed 100644 (file)
@@ -762,8 +762,8 @@ static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
  */
 static int ebml_read_binary(AVIOContext *pb, int length, EbmlBin *bin)
 {
-    av_free(bin->data);
-    if (!(bin->data = av_malloc(length)))
+    av_fast_padded_malloc(&bin->data, &bin->size, length);
+    if (!bin->data)
         return AVERROR(ENOMEM);
 
     bin->size = length;