X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Frtpdec_asf.c;h=b481c37c8206eaf0e6c9dbc2d0d9f5ef7eb6940b;hb=ac1d489320f476c18d6a8125f73389aecb73f3d3;hp=58c9068a873f148f0cfa7ca1ce7f3843cf2e19b4;hpb=058d03631afcaa4eb8f61c80c920a192b27d1ca2;p=ffmpeg

diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
index 58c9068a873..b481c37c820 100644
--- a/libavformat/rtpdec_asf.c
+++ b/libavformat/rtpdec_asf.c
@@ -107,10 +107,13 @@ int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
         init_packetizer(&pb, buf, len);
         if (rt->asf_ctx) {
-            av_close_input_stream(rt->asf_ctx);
+            av_close_input_file(rt->asf_ctx);
             rt->asf_ctx = NULL;
         }
-        ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
+        if (!(rt->asf_ctx = avformat_alloc_context()))
+            return AVERROR(ENOMEM);
+        rt->asf_ctx->pb      = &pb;
+        ret = avformat_open_input(&rt->asf_ctx, "", &ff_asf_demuxer, NULL);
         if (ret < 0)
             return ret;
         av_dict_copy(&s->metadata, rt->asf_ctx->metadata, 0);
@@ -230,8 +233,14 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
 
                 int cur_len = start_off + len_off - off;
                 int prev_len = out_len;
+                void *newmem;
                 out_len += cur_len;
-                asf->buf = av_realloc(asf->buf, out_len);
+                if (FFMIN(cur_len, len - off) < 0)
+                    return -1;
+                newmem = av_realloc(asf->buf, out_len);
+                if (!newmem)
+                    return -1;
+                asf->buf = newmem;
                 memcpy(asf->buf + prev_len, buf + off,
                        FFMIN(cur_len, len - off));
                 avio_skip(pb, cur_len);