Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mkvtoolnix for openSUSE:Factory checked in at 2026-09-14 16:26:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mkvtoolnix (Old) and /work/SRC/openSUSE:Factory/.mkvtoolnix.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mkvtoolnix" Mon Sep 14 16:26:59 2026 rev:183 rq:1377883 version:101.0 Changes: -------- --- /work/SRC/openSUSE:Factory/mkvtoolnix/mkvtoolnix.changes 2026-08-26 19:52:57.649125669 +0200 +++ /work/SRC/openSUSE:Factory/.mkvtoolnix.new.1265/mkvtoolnix.changes 2026-09-14 16:27:01.462241779 +0200 @@ -1,0 +2,7 @@ +Mon Sep 14 09:27:33 UTC 2026 - Luigi Baldoni <[email protected]> + +- Add fix-avilib_memory_allocation_failures.patch and + fix-avilib_heap_overflow.patch + (fix for boo#1280126 / CVE-2026-90783) + +------------------------------------------------------------------- New: ---- fix-avilib_heap_overflow.patch fix-avilib_memory_allocation_failures.patch ----------(New B)---------- New:- Add fix-avilib_memory_allocation_failures.patch and fix-avilib_heap_overflow.patch (fix for boo#1280126 / CVE-2026-90783) New: - Add fix-avilib_memory_allocation_failures.patch and fix-avilib_heap_overflow.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mkvtoolnix.spec ++++++ --- /var/tmp/diff_new_pack.qYMeux/_old 2026-09-14 16:27:03.076309307 +0200 +++ /var/tmp/diff_new_pack.qYMeux/_new 2026-09-14 16:27:03.078309390 +0200 @@ -27,6 +27,10 @@ Source1: https://mkvtoolnix.download/sources/mkvtoolnix-%{version}.tar.xz.sig # Sub-key ID 0x74AF00AD F2E32C85 of key ID 0x0F92290A 445B9007 is used for signing Source2: mkvtoolnix.keyring +# PATCH-FIX-UPSTREAM fix-avilib_memory_allocation_failures.patch -- boo#1280126 / CVE-2026-90783 +Patch0: fix-avilib_memory_allocation_failures.patch +# PATCH-FIX-UPSTREAM fix-avilib_heap_overflow.patch -- boo#1280126 / CVE-2026-90783 +Patch1: fix-avilib_heap_overflow.patch BuildRequires: desktop-file-utils BuildRequires: docbook-xsl-stylesheets BuildRequires: fdupes ++++++ fix-avilib_heap_overflow.patch ++++++ >From 1495126138e086080f0163bee27fafbdf956a1d0 Mon Sep 17 00:00:00 2001 From: Moritz Bunkus <[email protected]> Date: Tue, 25 Aug 2026 13:01:14 +0200 Subject: [PATCH] avilib: guard against heap overflow due to integer multiplication wrapping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `wLongsPerEntry` is an `uint16_t`, `nEntriesInUse` is an `uint32_t`. Automatic integer promotion during multiplication means `wLongsPerEntry` gets promoted to `uint32_t`, then those values are multiplied. If the result is bigger than `max(uint32_t)` it'll wrap around (colloquially: overflow). As the result is used for allocating memory and subsequent code assumes all required space has been allocated, it'll try to read from/write to memory beyond the end of the allocated buffer → heap overflow/invalid memory access. Affects the ODML index handling. --- lib/avilib-0.6.10/avilib.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-) Index: mkvtoolnix-101.0/lib/avilib-0.6.10/avilib.c =================================================================== --- mkvtoolnix-101.0.orig/lib/avilib-0.6.10/avilib.c +++ mkvtoolnix-101.0/lib/avilib-0.6.10/avilib.c @@ -61,6 +61,18 @@ static void *_saferealloc(void *p, size_t size, int line) { return mem; } +#define safemulu(a, b) _safemulu(a, b, __LINE__) +static size_t _safemulu(size_t a, size_t b, int line) { + size_t result = 0; + + if (__builtin_mul_overflow(a, b, &result)) { + fprintf(stderr, "avilib.c/_safemulu() called from line %d: __builtin_mul_overflow(%zu, %zu) indicated an overflow.\n", line, a, b); + exit(2); + } + + return result; +} + #if defined(COMP_MSC) || defined(COMP_MINGW) # define snprintf _snprintf # define strtoll(x,y,z) _atoi64(x) @@ -274,7 +286,13 @@ static int avi_add_chunk(avi_t *AVI, void *tag, void *data, int length) static int avi_ixnn_entry(avi_t *AVI, avistdindex_chunk *ch, avisuperindex_entry *en) { int bl, k; - unsigned int max = ch->nEntriesInUse * sizeof (uint32_t) * ch->wLongsPerEntry + 24; // header + size_t max = safemulu(ch->nEntriesInUse, sizeof (uint32_t) * ch->wLongsPerEntry) + 24; // header + + if (max >= (1ull << 32)) { + fprintf(stderr, "avilib.c/avi_ixnn_entry: aborting due to 32-bit integer overflow detection for index entry size\n"); + exit(2); + } + char *ix00 = safecalloc(1, max); char dfcc[5]; memcpy (dfcc, ch->fcc, 4); @@ -340,12 +358,12 @@ static int avi_init_super_index(avi_t *AVI, char *idxtag, avisuperindex_chunk ** memset (sil->dwReserved, 0, sizeof (sil->dwReserved)); // NR_IXNN_CHUNKS == allow 1024 indices which means 1024 GB files -- arbitrary - sil->aIndex = safecalloc(1, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); + sil->aIndex = safecalloc(1, (size_t)sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); if (!sil->aIndex) { AVI_errno = AVI_ERR_NO_MEM; return -1; } - memset (sil->aIndex, 0, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); + memset (sil->aIndex, 0, (size_t)sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); sil->stdindex = safecalloc(1, NR_IXNN_CHUNKS * sizeof (avistdindex_chunk *)); if (!sil->stdindex) { @@ -381,7 +399,7 @@ static int avi_add_std_index(avi_t *AVI, void *idxtag, void *strtag, //stdil->qwBaseOffset = AVI->video_superindex->aIndex[ cur_std_idx ]->qwOffset; - stdil->aIndex = safecalloc(1, stdil->dwSize * sizeof (uint32_t) * stdil->wLongsPerEntry); + stdil->aIndex = safecalloc(1, safemulu(stdil->dwSize, sizeof (uint32_t) * stdil->wLongsPerEntry)); if (!stdil->aIndex) { AVI_errno = AVI_ERR_NO_MEM; @@ -402,7 +420,7 @@ static int avi_add_odml_index_entry_core(avi_t *AVI, long flags, int64_t pos, un // need to fetch more memory if (cur_chunk_idx >= si->dwSize) { si->dwSize += 4096; - si->aIndex = saferealloc ( si->aIndex, si->dwSize * sizeof (uint32_t) * si->wLongsPerEntry); + si->aIndex = saferealloc ( si->aIndex, safemulu(si->dwSize, sizeof (uint32_t) * si->wLongsPerEntry)); } if(len>AVI->max_len) AVI->max_len=len; @@ -2576,7 +2594,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->video_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->video_superindex->aIndex = - safecalloc(1, AVI->video_superindex->wLongsPerEntry * AVI->video_superindex->nEntriesInUse * sizeof (uint32_t)); + safecalloc(1, safemulu(sizeof(uint32_t) * AVI->video_superindex->wLongsPerEntry, AVI->video_superindex->nEntriesInUse)); // position of ix## chunks for (j=0; j<AVI->video_superindex->nEntriesInUse; ++j) { @@ -2629,8 +2647,8 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->track[AVI->aptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->track[AVI->aptr].audio_superindex->aIndex = - safecalloc(1, AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry * - AVI->track[AVI->aptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); + safecalloc(1, safemulu(sizeof (uint32_t) * AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry, + AVI->track[AVI->aptr].audio_superindex->nEntriesInUse)); // position of ix## chunks for (j=0; j<AVI->track[AVI->aptr].audio_superindex->nEntriesInUse; ++j) { @@ -2678,8 +2696,8 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->ttrack[AVI->tptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->ttrack[AVI->tptr].audio_superindex->aIndex = - safecalloc(1, AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry * - AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); + safecalloc(1, safemulu(sizeof(uint32_t) * AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry, + AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse)); // position of ix## chunks for (j=0; j<AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse; ++j) { ++++++ fix-avilib_memory_allocation_failures.patch ++++++ >From 13fd81db3ae2b79d41536a9663719df11780797e Mon Sep 17 00:00:00 2001 From: Moritz Bunkus <[email protected]> Date: Tue, 25 Aug 2026 11:50:45 +0200 Subject: [PATCH] avilib: guard against memory allocation failures --- lib/avilib-0.6.10/avilib.c | 104 +++++++++++++++++++++++-------------- 1 file changed, 64 insertions(+), 40 deletions(-) Index: mkvtoolnix-101.0/lib/avilib-0.6.10/avilib.c =================================================================== --- mkvtoolnix-101.0.orig/lib/avilib-0.6.10/avilib.c +++ mkvtoolnix-101.0/lib/avilib-0.6.10/avilib.c @@ -37,6 +37,30 @@ #include "xio.h" +#define safecalloc(n, size) _safecalloc(n, size, __LINE__) + +static void *_safecalloc(size_t n, size_t size, int line) { + void *mem = calloc(n, size); + if (!mem) { + fprintf(stderr, "avilib.c/_safecalloc() called from line %d: calloc(%zu, %zu) returned nullptr for a size of %llu bytes.\n", line, n, size, (unsigned long long)n * (unsigned long long)size); + exit(2); + } + + return mem; +} + +#define saferealloc(p, size) _saferealloc(p, size, __LINE__) + +static void *_saferealloc(void *p, size_t size, int line) { + void *mem = realloc(p, size); + if (!mem) { + fprintf(stderr, "avilib.c/_saferealloc() called from line %d: realloc(%p, %zu) returned nullptr.\n", line, p, size); + exit(2); + } + + return mem; +} + #if defined(COMP_MSC) || defined(COMP_MINGW) # define snprintf _snprintf # define strtoll(x,y,z) _atoi64(x) @@ -251,7 +275,7 @@ static int avi_ixnn_entry(avi_t *AVI, avistdindex_chunk *ch, avisuperindex_entry { int bl, k; unsigned int max = ch->nEntriesInUse * sizeof (uint32_t) * ch->wLongsPerEntry + 24; // header - char *ix00 = calloc(1, max); + char *ix00 = safecalloc(1, max); char dfcc[5]; memcpy (dfcc, ch->fcc, 4); dfcc[4] = 0; @@ -302,7 +326,7 @@ static int avi_init_super_index(avi_t *AVI, char *idxtag, avisuperindex_chunk ** avisuperindex_chunk *sil = NULL; - if ((sil = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk))) == NULL) { + if ((sil = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk))) == NULL) { AVI_errno = AVI_ERR_NO_MEM; return -1; } @@ -316,20 +340,20 @@ static int avi_init_super_index(avi_t *AVI, char *idxtag, avisuperindex_chunk ** memset (sil->dwReserved, 0, sizeof (sil->dwReserved)); // NR_IXNN_CHUNKS == allow 1024 indices which means 1024 GB files -- arbitrary - sil->aIndex = calloc(1, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); + sil->aIndex = safecalloc(1, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); if (!sil->aIndex) { AVI_errno = AVI_ERR_NO_MEM; return -1; } memset (sil->aIndex, 0, sil->wLongsPerEntry * NR_IXNN_CHUNKS * sizeof (uint32_t)); - sil->stdindex = calloc(1, NR_IXNN_CHUNKS * sizeof (avistdindex_chunk *)); + sil->stdindex = safecalloc(1, NR_IXNN_CHUNKS * sizeof (avistdindex_chunk *)); if (!sil->stdindex) { AVI_errno = AVI_ERR_NO_MEM; return -1; } for (k = 0; k < NR_IXNN_CHUNKS; k++) { - sil->stdindex[k] = calloc(1, sizeof (avistdindex_chunk)); + sil->stdindex[k] = safecalloc(1, sizeof (avistdindex_chunk)); // gets rewritten later sil->stdindex[k]->qwBaseOffset = (uint64_t)k * NEW_RIFF_THRES; } @@ -357,7 +381,7 @@ static int avi_add_std_index(avi_t *AVI, void *idxtag, void *strtag, //stdil->qwBaseOffset = AVI->video_superindex->aIndex[ cur_std_idx ]->qwOffset; - stdil->aIndex = calloc(1, stdil->dwSize * sizeof (uint32_t) * stdil->wLongsPerEntry); + stdil->aIndex = safecalloc(1, stdil->dwSize * sizeof (uint32_t) * stdil->wLongsPerEntry); if (!stdil->aIndex) { AVI_errno = AVI_ERR_NO_MEM; @@ -378,7 +402,7 @@ static int avi_add_odml_index_entry_core(avi_t *AVI, long flags, int64_t pos, un // need to fetch more memory if (cur_chunk_idx >= si->dwSize) { si->dwSize += 4096; - si->aIndex = realloc ( si->aIndex, si->dwSize * sizeof (uint32_t) * si->wLongsPerEntry); + si->aIndex = saferealloc ( si->aIndex, si->dwSize * sizeof (uint32_t) * si->wLongsPerEntry); } if(len>AVI->max_len) AVI->max_len=len; @@ -577,8 +601,8 @@ static int avi_add_index_entry(avi_t *AVI, unsigned char *tag, long flags, unsig void *ptr; if(!AVI->idx || (AVI->n_idx>=AVI->max_idx)) { - ptr = realloc((void *)AVI->idx,(AVI->max_idx+4096)*16); - + ptr = saferealloc((void *)AVI->idx,(AVI->max_idx+4096)*16); + if(ptr == 0) { AVI_errno = AVI_ERR_NO_MEM; return -1; @@ -656,7 +680,7 @@ avi_t* AVI_open_output_file(void * filename) /* Allocate the avi_t struct and zero it */ - AVI = (avi_t *) calloc(1, sizeof(avi_t)); + AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); if(AVI==0) { AVI_errno = AVI_ERR_NO_MEM; @@ -1075,7 +1099,7 @@ static int avi_parse_comments (int fd, char *buf, int space_left) return -1; } - if ( !(data = calloc(1, st.st_size*sizeof(char)+1)) ) { + if ( !(data = safecalloc(1, st.st_size*sizeof(char)+1)) ) { fprintf(stderr, "calloc failed\n"); return -1; } @@ -2007,7 +2031,7 @@ avi_t *AVI_open_input_indexfile(void *filename, int getIndex, const char *indexf /* Create avi_t structure */ - AVI = (avi_t *) calloc(1, sizeof(avi_t)); + AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); if(AVI==NULL) { AVI_errno = AVI_ERR_NO_MEM; @@ -2051,7 +2075,7 @@ avi_t *AVI_open_indexfd(int fd, int getIndex, const char *indexfile) /* Create avi_t structure */ - AVI = (avi_t *) calloc(1, sizeof(avi_t)); + AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); if(AVI==NULL) { AVI_errno = AVI_ERR_NO_MEM; @@ -2085,7 +2109,7 @@ avi_t *AVI_open_input_file(void *filename, int getIndex) /* Create avi_t structure */ - AVI = (avi_t *) calloc(1, sizeof(avi_t)); + AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); if(AVI==NULL) { AVI_errno = AVI_ERR_NO_MEM; @@ -2124,7 +2148,7 @@ avi_t *AVI_open_fd(int fd, int getIndex) /* Create avi_t structure */ - AVI = (avi_t *) calloc(1, sizeof(avi_t)); + AVI = (avi_t *) safecalloc(1, sizeof(avi_t)); if(AVI==NULL) { AVI_errno = AVI_ERR_NO_MEM; @@ -2213,12 +2237,12 @@ int avi_parse_index_from_file(avi_t *AVI, const char *filename) for(j=0; j<AVI->anum; ++j) AVI->track[j].audio_chunks = aud_chunks[j]; if(AVI->video_frames==0) ERR_EXIT(AVI_ERR_NO_VIDS); - AVI->video_index = (video_index_entry *) calloc(1, vid_chunks*sizeof(video_index_entry)); + AVI->video_index = (video_index_entry *) safecalloc(1, vid_chunks*sizeof(video_index_entry)); if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); for(j=0; j<AVI->anum; ++j) { if(AVI->track[j].audio_chunks) { - AVI->track[j].audio_index = (audio_index_entry *) calloc(1, aud_chunks[j]*sizeof(audio_index_entry)); + AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, aud_chunks[j]*sizeof(audio_index_entry)); if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); } } @@ -2324,7 +2348,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if(strncasecmp(data,"hdrl",4) == 0) { hdrl_len = n; - hdrl_data = (unsigned char *) calloc(1, n); + hdrl_data = (unsigned char *) safecalloc(1, n); if(hdrl_data==0) ERR_EXIT(AVI_ERR_NO_MEM); // offset of header @@ -2347,7 +2371,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) break if this is not the case */ AVI->n_idx = AVI->max_idx = n/16; - AVI->idx = (unsigned char((*)[16]) ) calloc(1, n); + AVI->idx = (unsigned char((*)[16]) ) safecalloc(1, n); if(AVI->idx==0) ERR_EXIT(AVI_ERR_NO_MEM) if(avi_read(AVI->fdes, (char *) AVI->idx, n) != n ) { free ( AVI->idx); AVI->idx=NULL; @@ -2465,7 +2489,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if(lasttag == 1) { uint32_t ck_size = str2ulong(hdrl_data + i - 4); - AVI->bitmap_info_header = (alBITMAPINFOHEADER *)calloc(1, ck_size); + AVI->bitmap_info_header = (alBITMAPINFOHEADER *)safecalloc(1, ck_size); if (AVI->bitmap_info_header != NULL) { memcpy(AVI->bitmap_info_header, hdrl_data + i, ck_size); long2str(&AVI->bitmap_info_header->bi_size, @@ -2493,13 +2517,13 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) wfes = hdrl_len - i; else wfes = sizeof(alWAVEFORMATEX); - wfe = (alWAVEFORMATEX *)calloc(1, sizeof(alWAVEFORMATEX)); + wfe = (alWAVEFORMATEX *)safecalloc(1, sizeof(alWAVEFORMATEX)); if (wfe != NULL) { memset(wfe, 0, sizeof(alWAVEFORMATEX)); memcpy(wfe, hdrl_data + i, wfes); if (str2ushort((unsigned char *)&wfe->cb_size) != 0) { nwfe = (char *) - realloc(wfe, sizeof(alWAVEFORMATEX) + + saferealloc(wfe, sizeof(alWAVEFORMATEX) + str2ushort((unsigned char *)&wfe->cb_size)); if (nwfe != 0) { int64_t lpos = xio_lseek(AVI->fdes, 0, SEEK_CUR); @@ -2537,7 +2561,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) a = (char *)(hdrl_data+i); - AVI->video_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); + AVI->video_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); memcpy (AVI->video_superindex->fcc, a, 4); a += 4; AVI->video_superindex->dwSize = str2ulong(a); a += 4; AVI->video_superindex->wLongsPerEntry = str2ushort(a); a += 2; @@ -2552,7 +2576,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->video_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->video_superindex->aIndex = - calloc(1, AVI->video_superindex->wLongsPerEntry * AVI->video_superindex->nEntriesInUse * sizeof (uint32_t)); + safecalloc(1, AVI->video_superindex->wLongsPerEntry * AVI->video_superindex->nEntriesInUse * sizeof (uint32_t)); // position of ix## chunks for (j=0; j<AVI->video_superindex->nEntriesInUse; ++j) { @@ -2590,7 +2614,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) a = (char *)(hdrl_data+i); - AVI->track[AVI->aptr].audio_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); + AVI->track[AVI->aptr].audio_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); memcpy (AVI->track[AVI->aptr].audio_superindex->fcc, a, 4); a += 4; AVI->track[AVI->aptr].audio_superindex->dwSize = str2ulong(a); a += 4; AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry = str2ushort(a); a += 2; @@ -2605,7 +2629,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->track[AVI->aptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->track[AVI->aptr].audio_superindex->aIndex = - calloc(1, AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry * + safecalloc(1, AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry * AVI->track[AVI->aptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); // position of ix## chunks @@ -2639,7 +2663,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) a = (char *)(hdrl_data+i); - AVI->ttrack[AVI->tptr].audio_superindex = (avisuperindex_chunk *) calloc(1, sizeof (avisuperindex_chunk)); + AVI->ttrack[AVI->tptr].audio_superindex = (avisuperindex_chunk *) safecalloc(1, sizeof (avisuperindex_chunk)); memcpy (AVI->ttrack[AVI->tptr].audio_superindex->fcc, a, 4); a += 4; AVI->ttrack[AVI->tptr].audio_superindex->dwSize = str2ulong(a); a += 4; AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry = str2ushort(a); a += 2; @@ -2654,7 +2678,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) if (AVI->ttrack[AVI->tptr].audio_superindex->bIndexSubType != 0) {fprintf(stderr, "Invalid Header, bIndexSubType != 0\n"); } AVI->ttrack[AVI->tptr].audio_superindex->aIndex = - calloc(1, AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry * + safecalloc(1, AVI->ttrack[AVI->tptr].audio_superindex->wLongsPerEntry * AVI->ttrack[AVI->tptr].audio_superindex->nEntriesInUse * sizeof (uint32_t)); // position of ix## chunks @@ -2831,7 +2855,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) for (j=0; j<AVI->video_superindex->nEntriesInUse; j++) { // read from file - chunk_start = en = calloc(1, AVI->video_superindex->aIndex[j].dwSize+odml_hrdl_len); + chunk_start = en = safecalloc(1, AVI->video_superindex->aIndex[j].dwSize+odml_hrdl_len); if (xio_lseek(AVI->fdes, AVI->video_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, */ @@ -2857,7 +2881,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) // skip header en += odml_hrdl_len; nvi += nrEntries; - AVI->video_index = (video_index_entry *) realloc (AVI->video_index, nvi * sizeof (video_index_entry)); + AVI->video_index = (video_index_entry *) saferealloc (AVI->video_index, nvi * sizeof (video_index_entry)); if (!AVI->video_index) { fprintf(stderr, "AVILIB: out of mem (size = %ld)\n", (long)(nvi * sizeof (video_index_entry))); exit(1); @@ -2912,7 +2936,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) for (j=0; j<AVI->track[audtr].audio_superindex->nEntriesInUse; j++) { // read from file - chunk_start = en = calloc(1, AVI->track[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); + chunk_start = en = safecalloc(1, AVI->track[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); if (xio_lseek(AVI->fdes, AVI->track[audtr].audio_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, (unsigned long long)AVI->track[audtr].audio_superindex->aIndex[j].qwOffset); */ @@ -2937,7 +2961,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) // skip header en += odml_hrdl_len; nai[audtr] += nrEntries; - AVI->track[audtr].audio_index = (audio_index_entry *) realloc (AVI->track[audtr].audio_index, nai[audtr] * sizeof (audio_index_entry)); + AVI->track[audtr].audio_index = (audio_index_entry *) saferealloc (AVI->track[audtr].audio_index, nai[audtr] * sizeof (audio_index_entry)); while (k < nai[audtr]) { @@ -2979,7 +3003,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) for (j=0; j<AVI->ttrack[audtr].audio_superindex->nEntriesInUse; j++) { // read from file - chunk_start = en = calloc(1, AVI->ttrack[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); + chunk_start = en = safecalloc(1, AVI->ttrack[audtr].audio_superindex->aIndex[j].dwSize+odml_hrdl_len); if (xio_lseek(AVI->fdes, AVI->ttrack[audtr].audio_superindex->aIndex[j].qwOffset, SEEK_SET) == (int64_t)-1) { /* fprintf(stderr, "(%s) cannot seek to 0x%llx\n", __FILE__, (unsigned long long)AVI->ttrack[audtr].audio_superindex->aIndex[j].qwOffset); */ @@ -3001,7 +3025,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) // skip header en += odml_hrdl_len; nti[audtr] += nrEntries; - AVI->ttrack[audtr].audio_index = (audio_index_entry *) realloc (AVI->ttrack[audtr].audio_index, nti[audtr] * sizeof (audio_index_entry)); + AVI->ttrack[audtr].audio_index = (audio_index_entry *) saferealloc (AVI->ttrack[audtr].audio_index, nti[audtr] * sizeof (audio_index_entry)); while (k < nti[audtr]) { @@ -3050,13 +3074,13 @@ multiple_riff: nai[0] = AVI->track[0].audio_chunks = AVI->total_frames; for(j=1; j<AVI->anum; ++j) AVI->track[j].audio_chunks = 0; - AVI->video_index = (video_index_entry *) calloc(1, nvi*sizeof(video_index_entry)); + AVI->video_index = (video_index_entry *) safecalloc(1, nvi*sizeof(video_index_entry)); if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); for(j=0; j<AVI->anum; ++j) { if(AVI->track[j].audio_chunks) { - AVI->track[j].audio_index = (audio_index_entry *) calloc(1, (nai[j]+1)*sizeof(audio_index_entry)); + AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, (nai[j]+1)*sizeof(audio_index_entry)); memset(AVI->track[j].audio_index, 0, (nai[j]+1)*(sizeof(audio_index_entry))); if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); } @@ -3079,8 +3103,8 @@ multiple_riff: if (aud_chunks - nai[j] -1 <= 0) { aud_chunks += AVI->total_frames; - AVI->track[j].audio_index = (audio_index_entry *) - realloc( AVI->track[j].audio_index, (aud_chunks+1)*sizeof(audio_index_entry)); + AVI->track[j].audio_index = (audio_index_entry *) + saferealloc( AVI->track[j].audio_index, (aud_chunks+1)*sizeof(audio_index_entry)); if (!AVI->track[j].audio_index) { fprintf(stderr, "Internal error in avilib -- no mem\n"); AVI_errno = AVI_ERR_NO_MEM; @@ -3167,12 +3191,12 @@ multiple_riff: if(AVI->video_frames==0) ERR_EXIT(AVI_ERR_NO_VIDS); - AVI->video_index = (video_index_entry *) calloc(1, nvi*sizeof(video_index_entry)); + AVI->video_index = (video_index_entry *) safecalloc(1, nvi*sizeof(video_index_entry)); if(AVI->video_index==0) ERR_EXIT(AVI_ERR_NO_MEM); for(j=0; j<AVI->anum; ++j) { if(AVI->track[j].audio_chunks) { - AVI->track[j].audio_index = (audio_index_entry *) calloc(1, (nai[j]+1)*sizeof(audio_index_entry)); + AVI->track[j].audio_index = (audio_index_entry *) safecalloc(1, (nai[j]+1)*sizeof(audio_index_entry)); memset(AVI->track[j].audio_index, 0, (nai[j]+1)*(sizeof(audio_index_entry))); if(AVI->track[j].audio_index==0) ERR_EXIT(AVI_ERR_NO_MEM); }
