X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Favienc.c;h=b4dc65c24372c5bd8210d0028664df5e4a9bc5ae;hb=988f585fcb1cfb40fe4b706c32b31594b536bba0;hp=19cabe2aef77b94ebde96f4f84a5147801dea8e2;hpb=0ed7bc49a3f7accc4952372b914eb584b1201c86;p=ffmpeg

diff --git a/libavformat/avienc.c b/libavformat/avienc.c
index 19cabe2aef7..b4dc65c2437 100644
--- a/libavformat/avienc.c
+++ b/libavformat/avienc.c
@@ -523,6 +523,11 @@ static int avi_write_packet(AVFormatContext *s, AVPacket *pkt)
     while(enc->block_align==0 && pkt->dts != AV_NOPTS_VALUE && pkt->dts > avist->packet_count){
         AVPacket empty_packet;
 
+        if(pkt->dts - avist->packet_count > 60000){
+            av_log(s, AV_LOG_ERROR, "Too large number of skiped frames %Ld\n", pkt->dts - avist->packet_count);
+            return AVERROR(EINVAL);
+        }
+
         av_init_packet(&empty_packet);
         empty_packet.size= 0;
         empty_packet.data= NULL;
@@ -558,7 +563,7 @@ static int avi_write_packet(AVFormatContext *s, AVPacket *pkt)
         int cl = idx->entry / AVI_INDEX_CLUSTER_SIZE;
         int id = idx->entry % AVI_INDEX_CLUSTER_SIZE;
         if (idx->ents_allocated <= idx->entry) {
-            idx->cluster = av_realloc(idx->cluster, (cl+1)*sizeof(void*));
+            idx->cluster = av_realloc_f(idx->cluster, sizeof(void*), cl+1);
             if (!idx->cluster)
                 return -1;
             idx->cluster[cl] = av_malloc(AVI_INDEX_CLUSTER_SIZE*sizeof(AVIIentry));