nsvdec: Check av_malloc(string_size)
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 29 Dec 2011 20:31:22 +0000 (21:31 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Jan 2012 21:41:16 +0000 (22:41 +0100)
This can easily be NULL as string_size can be 2g in a damaged file.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b9e0e9537a3ec4af1630e9f1b8d0ce68885cac16)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/nsvdec.c

index 72d626a..76bcd4a 100644 (file)
@@ -314,6 +314,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s, AVFormatParameters *ap)
         char quote;
 
         p = strings = av_mallocz(strings_size + 1);
+        if (!p)
+            return AVERROR(ENOMEM);
         endp = strings + strings_size;
         avio_read(pb, strings, strings_size);
         while (p < endp) {