int flag;
int user_data_type_code;
int cc_count;
- int i;
GetBitContext *gb = &s->HEVClc->gb;
size -= 2;
if (cc_count && size >= cc_count * 3) {
- av_freep(&s->a53_caption);
- s->a53_caption_size = cc_count * 3;
-
- s->a53_caption = av_malloc(s->a53_caption_size);
- if (!s->a53_caption)
- return(AVERROR(ENOMEM));
-
- for (i = 0; i < s->a53_caption_size; i++) {
- s->a53_caption[i++] = get_bits(gb, 8);
+ const uint64_t new_size = (s->a53_caption_size + cc_count
+ * UINT64_C(3));
+ int i, ret;
+
+ if (new_size > INT_MAX)
+ return AVERROR(EINVAL);
+
+ /* Allow merging of the cc data from two fields. */
+ ret = av_reallocp(&s->a53_caption, new_size);
+ if (ret < 0)
+ return ret;
+
+ for (i = 0; i < cc_count; i++) {
+ s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
+ s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
+ s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
}
skip_bits(gb, 8); // marker_bits
}
}
} else {
+ int i;
for (i = 0; i < size - 1; i++)
skip_bits(gb, 8);
}