---
 libavformat/matroskadec.c |   14 ++++++++++++++
 1 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 0379977..f04fac8 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -806,6 +806,8 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
     if (syntax->list_elem_size) {
         EbmlList *list = data;
         list->elem = av_realloc(list->elem, 
(list->nb_elem+1)*syntax->list_elem_size);
+        if (!list->elem)
+            return AVERROR(ENOMEM);
         data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
         memset(data, 0, syntax->list_elem_size);
         list->nb_elem++;
@@ -949,6 +951,8 @@ static int matroska_decode_buffer(uint8_t** buf, int* 
buf_size,
         do {
             olen = pkt_size *= 3;
             pkt_data = av_realloc(pkt_data, pkt_size+AV_LZO_OUTPUT_PADDING);
+            if (!pkt_data)
+                goto failed;
             result = av_lzo1x_decode(pkt_data, &olen, data, &isize);
         } while (result==AV_LZO_OUTPUT_FULL && pkt_size<10000000);
         if (result)
@@ -965,6 +969,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* 
buf_size,
         do {
             pkt_size *= 3;
             pkt_data = av_realloc(pkt_data, pkt_size);
+            if (!pkt_data) {
+                inflateEnd(&zstream);
+                goto failed;
+            }
             zstream.avail_out = pkt_size - zstream.total_out;
             zstream.next_out = pkt_data + zstream.total_out;
             result = inflate(&zstream, Z_NO_FLUSH);
@@ -986,6 +994,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* 
buf_size,
         do {
             pkt_size *= 3;
             pkt_data = av_realloc(pkt_data, pkt_size);
+            if (!pkt_data) {
+                BZ2_bzDecompressEnd(&bzstream);
+                goto failed;
+            }
             bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
             bzstream.next_out = pkt_data + bzstream.total_out_lo32;
             result = BZ2_bzDecompress(&bzstream);
@@ -1608,6 +1620,8 @@ static int matroska_deliver_packet(MatroskaDemuxContext 
*matroska,
             matroska->packets =
                 av_realloc(matroska->packets, (matroska->num_packets - 1) *
                            sizeof(AVPacket *));
+            if (!matroska->packets)
+                return -1;
         } else {
             av_freep(&matroska->packets);
         }
-- 
1.7.0.4

_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to