dsicin demuxer: Fix excessive malloc()
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 19 Dec 2011 10:47:15 +0000 (11:47 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 19 Dec 2011 10:57:34 +0000 (11:57 +0100)
use ffio_limit()
Fixes Ticket 790
Bug found by: Oana Stratulat

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/dsicin.c

index 20b1d02..e0db8ba 100644 (file)
@@ -27,6 +27,7 @@
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
 #include "internal.h"
+#include "avio_internal.h"
 
 
 typedef struct CinFileHeader {
@@ -179,6 +180,8 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt)
         /* palette and video packet */
         pkt_size = (palette_type + 3) * hdr->pal_colors_count + hdr->video_frame_size;
 
+        pkt_size = ffio_limit(pb, pkt_size);
+
         ret = av_new_packet(pkt, 4 + pkt_size);
         if (ret < 0)
             return ret;