typedef struct EbmlList {
int nb_elem;
+ unsigned int alloc_elem_size;
void *elem;
} EbmlList;
data = (char *) data + syntax->data_offset;
if (syntax->list_elem_size) {
EbmlList *list = data;
- void *newelem = av_realloc_array(list->elem, list->nb_elem + 1,
- syntax->list_elem_size);
+ void *newelem;
+
+ if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size)
+ return AVERROR(ENOMEM);
+ newelem = av_fast_realloc(list->elem,
+ &list->alloc_elem_size,
+ (list->nb_elem + 1) * syntax->list_elem_size);
if (!newelem)
return AVERROR(ENOMEM);
list->elem = newelem;
ebml_free(syntax[i].def.n, ptr);
av_freep(&list->elem);
list->nb_elem = 0;
+ list->alloc_elem_size = 0;
} else
ebml_free(syntax[i].def.n, data_off);
default: