break;
case EBML_STR:
case EBML_UTF8:
- *(char **)((char *)data+syntax[i].data_offset) = av_strdup(syntax[i].def.s);
+ // the default may be NULL
+ if (syntax[i].def.s) {
+ uint8_t **dst = (uint8_t**)((uint8_t*)data + syntax[i].data_offset);
+ *dst = av_strdup(syntax[i].def.s);
+ if (!*dst)
+ return AVERROR(ENOMEM);
+ }
break;
}
track->audio.sub_packet_h = avio_rb16(&b);
track->audio.frame_size = avio_rb16(&b);
track->audio.sub_packet_size = avio_rb16(&b);
+ if (flavor <= 0 || track->audio.coded_framesize <= 0 ||
+ track->audio.sub_packet_h <= 0 || track->audio.frame_size <= 0 ||
+ track->audio.sub_packet_size <= 0)
+ return AVERROR_INVALIDDATA;
track->audio.buf = av_malloc(track->audio.frame_size * track->audio.sub_packet_h);
if (codec_id == AV_CODEC_ID_RA_288) {
st->codec->block_align = track->audio.coded_framesize;