avcodec/av1_parse: Use av_fast_realloc() for OBU array

Based on commits 22bec0d33f4231487547581a1f77e2e8e6eade88 and
cebb446911fdc6c42d5a480b441b025c399e4a88.

Signed-off-by: James Almer <jamrial@gmail.com>

diff --git a/libavcodec/av1_parse.c b/libavcodec/av1_parse.c
index 6742bc152d7ffab0cbe0130bc76044575a1dd4b4..59ea0bc6e75720cf3fad820aaceb3eb3e1be30e3 100644 (file)
--- a/libavcodec/av1_parse.c
+++ b/libavcodec/av1_parse.c
@@ -66,7 +66,11 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 
         if (pkt->obus_allocated < pkt->nb_obus + 1) {
             int new_size = pkt->obus_allocated + 1;
-            AV1OBU *tmp = av_realloc_array(pkt->obus, new_size, sizeof(*tmp));
+            AV1OBU *tmp;
+
+            if (new_size >= INT_MAX / sizeof(*tmp))
+                return AVERROR(ENOMEM);
+            tmp = av_fast_realloc(pkt->obus, &pkt->obus_allocated_size, new_size * sizeof(*tmp));
             if (!tmp)
                 return AVERROR(ENOMEM);
 
@@ -102,5 +106,5 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 void ff_av1_packet_uninit(AV1Packet *pkt)
 {
     av_freep(&pkt->obus);
-    pkt->obus_allocated = 0;
+    pkt->obus_allocated = pkt->obus_allocated_size = 0;
 }

diff --git a/libavcodec/av1_parse.h b/libavcodec/av1_parse.h
index 864308f81da2a68723bc979deb4f0b71d3da8ccc..f3d932bc5507e0c433435e2ff970cbd93006ff79 100644 (file)
--- a/libavcodec/av1_parse.h
+++ b/libavcodec/av1_parse.h
@@ -56,6 +56,7 @@ typedef struct AV1Packet {
     AV1OBU *obus;
     int nb_obus;
     int obus_allocated;
+    unsigned obus_allocated_size;
 } AV1Packet;
 
 /**