[FFmpeg-devel] [PATCH 2/2 v2] avformat/matroskadec: use av_fast_realloc to reallocate ebml list arrays

[James Almer]

On 9/4/2019 1:37 AM, James Almer wrote:
> On 9/4/2019 1:21 AM, Carl Eugen Hoyos wrote:
>>
>>
>> Von meinem iPhone gesendet
>>
>>> Am 04.09.2019 um 01:03 schrieb James Almer <jamrial at gmail.com>:
>>>
>>> Speeds up the process considerably.
>>>
>>> Fixes ticket #8109.
>>>
>>> Suggested-by: nevcairiel
>>> Suggested-by: cehoyos
>>> Signed-off-by: James Almer <jamrial at gmail.com>
>>> ---
>>> libavformat/matroskadec.c | 12 ++++++++++--
>>> 1 file changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
>>> index 439ee462a5..0f227eb33d 100644
>>> --- a/libavformat/matroskadec.c
>>> +++ b/libavformat/matroskadec.c
>>> @@ -110,6 +110,7 @@ typedef const struct EbmlSyntax {
>>>
>>> typedef struct EbmlList {
>>>     int nb_elem;
>>> +    unsigned int alloc_elem_size;
>>>     void *elem;
>>> } EbmlList;
>>>
>>> @@ -1236,8 +1237,14 @@ static int ebml_parse(MatroskaDemuxContext *matroska,
>>>         data = (char *) data + syntax->data_offset;
>>>         if (syntax->list_elem_size) {
>>>             EbmlList *list = data;
>>> -            void *newelem = av_realloc_array(list->elem, list->nb_elem + 1,
>>> -                                                   syntax->list_elem_size);
>>> +            void *newelem;
>>
>>> +            if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size)
>>> +                return AVERROR(ENOMEM);
>>
>> I would have naively expected this to use INT_MAX.
> 
> The size parameter in av_fast_realloc() is unsigned int.
> av_add_index_entry() does the exact same check.
> 
>>
>> And please reconsider backporting random fixes for issues that are not regressions.
> 
> Despite not being a regression, the speed up from this fix on real world
> files is considerable, so it's worth backporting to at least release/4.2.

Pushed.