X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fav1_parse.c;h=59ea0bc6e75720cf3fad820aaceb3eb3e1be30e3;hb=1ec87f50f42a16f9228444dc08aa8264879f61e1;hp=cdd524baa875f5b96ced1e99785a2e6d70f508dc;hpb=e4e04dce1fab81bcdef82e60184d50c73d212c6a;p=ffmpeg

diff --git a/libavcodec/av1_parse.c b/libavcodec/av1_parse.c
index cdd524baa87..59ea0bc6e75 100644
--- a/libavcodec/av1_parse.c
+++ b/libavcodec/av1_parse.c
@@ -66,13 +66,16 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 
         if (pkt->obus_allocated < pkt->nb_obus + 1) {
             int new_size = pkt->obus_allocated + 1;
-            AV1OBU *tmp = av_realloc_array(pkt->obus, new_size, sizeof(*tmp));
+            AV1OBU *tmp;
+
+            if (new_size >= INT_MAX / sizeof(*tmp))
+                return AVERROR(ENOMEM);
+            tmp = av_fast_realloc(pkt->obus, &pkt->obus_allocated_size, new_size * sizeof(*tmp));
             if (!tmp)
                 return AVERROR(ENOMEM);
 
             pkt->obus = tmp;
-            memset(pkt->obus + pkt->obus_allocated, 0,
-                   (new_size - pkt->obus_allocated) * sizeof(*tmp));
+            memset(pkt->obus + pkt->obus_allocated, 0, sizeof(*pkt->obus));
             pkt->obus_allocated = new_size;
         }
         obu = &pkt->obus[pkt->nb_obus];
@@ -103,5 +106,5 @@ int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *lo
 void ff_av1_packet_uninit(AV1Packet *pkt)
 {
     av_freep(&pkt->obus);
-    pkt->obus_allocated = 0;
+    pkt->obus_allocated = pkt->obus_allocated_size = 0;
 }