Use calloc() instead of malloc() - fixes integer overflow...

...assuming you have non-buggy calloc() implementation.

Pointed-out-by: Drew Yao
Signed-off-by: Rémi Denis-Courmont <rem@videolan.org>

diff --git a/modules/demux/real.c b/modules/demux/real.c
index 7f0c585453aa2ac6a7184efc3c6c2fa8acf01255..f0f66aebd2a71bf498742c62aca21bae4b54ba28 100644 (file)
--- a/modules/demux/real.c
+++ b/modules/demux/real.c
@@ -1240,18 +1240,16 @@ static int ReadCodecSpecificData( demux_t *p_demux, int i_len, int i_num )
                 tk->i_subpackets =
                     i_subpacket_h * i_frame_size / tk->i_subpacket_size;
                 tk->p_subpackets =
-                    malloc( tk->i_subpackets * sizeof(block_t *) );
+                    calloc( tk->i_subpackets, sizeof(block_t *) );
             }
             else if( fmt.i_codec == VLC_FOURCC('2','8','_','8') )
             {
                 tk->i_subpackets =
                     i_subpacket_h * i_frame_size / tk->i_coded_frame_size;
                 tk->p_subpackets =
-                    malloc( tk->i_subpackets * sizeof(block_t *) );
+                    calloc( tk->i_subpackets, sizeof(block_t *) );
             }
 
-            for( i = 0; i < tk->i_subpackets; i++ ) tk->p_subpackets[i] = NULL;
-
             tk->p_es = es_out_Add( p_demux->out, &fmt );
 
             TAB_APPEND( p_sys->i_track, p_sys->track, tk );