offset = ptr;
bytestream_put_le32(&ptr, 0);
- strip_sizes = av_mallocz_array(strips, sizeof(*strip_sizes));
- strip_offsets = av_mallocz_array(strips, sizeof(*strip_offsets));
- if (!strip_sizes || !strip_offsets) {
++ if (strips > INT_MAX / FFMAX(sizeof(s->strip_sizes[0]), sizeof(s->strip_offsets[0]))) {
++ ret = AVERROR(ENOMEM);
++ goto fail;
++ }
+ av_fast_padded_mallocz(&s->strip_sizes , &s->strip_sizes_size , sizeof(s->strip_sizes [0]) * strips);
+ av_fast_padded_mallocz(&s->strip_offsets, &s->strip_offsets_size, sizeof(s->strip_offsets[0]) * strips);
+
+ if (!s->strip_sizes || !s->strip_offsets) {
ret = AVERROR(ENOMEM);
goto fail;
}