Commit 7350c59e authored by James Almer's avatar James Almer

decode: add a frame tile data buffer size check

This check was already done in dav1d_parse_obus(), so it's added as an assert
here for extra precaution.
parent f821d9ad
...@@ -3196,6 +3196,7 @@ int dav1d_submit_frame(Dav1dContext *const c) { ...@@ -3196,6 +3196,7 @@ int dav1d_submit_frame(Dav1dContext *const c) {
// FIXME qsort so tiles are in order (for frame threading) // FIXME qsort so tiles are in order (for frame threading)
if (f->n_tile_data_alloc < c->n_tile_data) { if (f->n_tile_data_alloc < c->n_tile_data) {
freep(&f->tile); freep(&f->tile);
assert(c->n_tile_data < INT_MAX / (int)sizeof(*f->tile));
f->tile = malloc(c->n_tile_data * sizeof(*f->tile)); f->tile = malloc(c->n_tile_data * sizeof(*f->tile));
if (!f->tile) goto error; if (!f->tile) goto error;
f->n_tile_data_alloc = c->n_tile_data; f->n_tile_data_alloc = c->n_tile_data;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment