shithub: dav1d

Info  •  Files  •  Log  •  Branches

decode: add a frame tile data buffer size check

This check was already done in dav1d_parse_obus(), so it's added as an assert
here for extra precaution.

--- a/src/decode.c

+++ b/src/decode.c

@@ -3196,6 +3196,7 @@

     // FIXME qsort so tiles are in order (for frame threading)

     if (f->n_tile_data_alloc < c->n_tile_data) {

         freep(&f->tile);

+        assert(c->n_tile_data < INT_MAX / (int)sizeof(*f->tile));

         f->tile = malloc(c->n_tile_data * sizeof(*f->tile));

         if (!f->tile) goto error;

         f->n_tile_data_alloc = c->n_tile_data;