X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhevc_sei.c;h=46cd06b3645376eb0cabbc7b8e77e5f30a39ad75;hb=352bd18dff147ec1150c32a034046c6420ae1d36;hp=e853067cc4f7b52e2f55cfa3c7e62c96e7ea0cbf;hpb=3df9ec5ce7bc57ee303e715b949f65727a52c916;p=ffmpeg

diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c
index e853067cc4f..46cd06b3645 100644
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -151,7 +151,6 @@ static int decode_registered_user_data_closed_caption(HEVCContext *s, int size)
     int flag;
     int user_data_type_code;
     int cc_count;
-    int i;
 
     GetBitContext *gb = &s->HEVClc->gb;
 
@@ -170,20 +169,28 @@ static int decode_registered_user_data_closed_caption(HEVCContext *s, int size)
             size -= 2;
 
             if (cc_count && size >= cc_count * 3) {
-                av_freep(&s->a53_caption);
-                s->a53_caption_size = cc_count * 3;
-
-                s->a53_caption = av_malloc(s->a53_caption_size);
-                if (!s->a53_caption)
-                    return(AVERROR(ENOMEM));
-
-                for (i = 0; i < s->a53_caption_size; i++) {
-                    s->a53_caption[i++] = get_bits(gb, 8);
+                const uint64_t new_size = (s->a53_caption_size + cc_count
+                                           * UINT64_C(3));
+                int i, ret;
+
+                if (new_size > INT_MAX)
+                    return AVERROR(EINVAL);
+
+                /* Allow merging of the cc data from two fields. */
+                ret = av_reallocp(&s->a53_caption, new_size);
+                if (ret < 0)
+                    return ret;
+
+                for (i = 0; i < cc_count; i++) {
+                    s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
+                    s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
+                    s->a53_caption[s->a53_caption_size++] = get_bits(gb, 8);
                 }
                 skip_bits(gb, 8); // marker_bits
             }
         }
     } else {
+        int i;
         for (i = 0; i < size - 1; i++)
             skip_bits(gb, 8);
     }