From eb5571e57e366d8a812e1f056a707045b0c67bd8 Mon Sep 17 00:00:00 2001
From: reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2>
Date: Wed, 30 Sep 2009 07:41:00 +0000
Subject: [PATCH] Check for integer overflow in grow_array.

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@29736 b3059339-0415-0410-9bf9-f77b7e298cf2
---
 libmpdemux/demux_mkv.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libmpdemux/demux_mkv.c b/libmpdemux/demux_mkv.c
index 21dc246f7f..0804dcf5bb 100644
--- a/libmpdemux/demux_mkv.c
+++ b/libmpdemux/demux_mkv.c
@@ -213,7 +213,10 @@ static void grow_array(void *arrayp, int nelem, size_t elsize) {
   void *oldp = *array;
   if (nelem & 31)
     return;
-  *array = realloc(*array, (nelem + 32) * elsize);
+  if (nelem > UINT_MAX / elsize - 32)
+    *array = NULL;
+  else
+    *array = realloc(*array, (nelem + 32) * elsize);
   if (!*array)
     free(oldp);
 }