The check has been added at a time when the code performed the
multiplication itself instead of deferring it to av_malloc_array()
and when our allocation functions used unsigned instead of size_t.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
return AVERROR_INVALIDDATA;
film->base_clock = AV_RB32(&scratch[8]);
film->sample_count = AV_RB32(&scratch[12]);
- if(film->sample_count >= UINT_MAX / sizeof(film_sample))
- return -1;
film->sample_table = av_malloc_array(film->sample_count, sizeof(film_sample));
if (!film->sample_table)
return AVERROR(ENOMEM);