@@ -692,11 +692,11 @@ static int avi_read_header(AVFormatContext *s)

                     if (st->codec->codec_tag == 0 && st->codec->height > 0 &&

                         st->codec->extradata_size < 1U << 30) {

                         st->codec->extradata_size += 9;

-                        st->codec->extradata       = av_realloc_f(st->codec->extradata,

-                                                                  1,

-                                                                  st->codec->extradata_size +

-                                                                  FF_INPUT_BUFFER_PADDING_SIZE);

-                        if (st->codec->extradata)

+                        if ((ret = av_reallocp(&st->codec->extradata,

+                                               st->codec->extradata_size +

+                                               FF_INPUT_BUFFER_PADDING_SIZE)) < 0)

+                            return ret;

+                        else

                             memcpy(st->codec->extradata + st->codec->extradata_size - 9,

                                    "BottomUp", 9);

                     }

@@ -562,6 +562,7 @@ static int avi_write_packet(AVFormatContext *s, AVPacket *pkt)

     }

     if (s->pb->seekable) {

+        int err;

         AVIIndex* idx = &avist->indexes;

         int cl = idx->entry / AVI_INDEX_CLUSTER_SIZE;

         int id = idx->entry % AVI_INDEX_CLUSTER_SIZE;

@@ -949,9 +949,9 @@ static int dyn_buf_write(void *opaque, uint8_t *buf, int buf_size)

     }

     if (new_allocated_size > d->allocated_size) {

-        d->buffer = av_realloc_f(d->buffer, 1, new_allocated_size);

-        if(d->buffer == NULL)

-             return AVERROR(ENOMEM);

+        int err;

+        if ((err = av_reallocp(&d->buffer, new_allocated_size)) < 0)

+            return err;

         d->allocated_size = new_allocated_size;

     }

     memcpy(d->buffer + d->pos, buf, buf_size);

@@ -71,7 +71,7 @@ static int bmv_read_header(AVFormatContext *s)

 static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)

 {

     BMVContext *c = s->priv_data;

-    int type;

+    int type, err;

     void *tmp;

     while (c->get_next) {

@@ -85,10 +85,8 @@ static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)

         c->size = avio_rl24(s->pb);

         if (!c->size)

             return AVERROR_INVALIDDATA;

-        tmp = av_realloc(c->packet, c->size + 1);

-        if (!tmp)

-            return AVERROR(ENOMEM);

-        c->packet = tmp;

+        if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)

+            return err;

         c->packet[0] = type;

         if (avio_read(s->pb, c->packet + 1, c->size) != c->size)

             return AVERROR(EIO);

@@ -56,7 +56,7 @@ static av_cold int concat_close(URLContext *h)

 static av_cold int concat_open(URLContext *h, const char *uri, int flags)

 {

-    char *node_uri = NULL, *tmp_uri;

+    char *node_uri = NULL;

     int err = 0;

     int64_t size;

     size_t  len, i;

@@ -85,11 +85,8 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags)

     for (i = 0; *uri; i++) {

         /* parsing uri */

         len = strcspn(uri, AV_CAT_SEPARATOR);

-        if (!(tmp_uri = av_realloc(node_uri, len+1))) {

-            err = AVERROR(ENOMEM);

+        if ((err = av_reallocp(&node_uri, len + 1)) < 0)

             break;

-        } else

-            node_uri = tmp_uri;

         av_strlcpy(node_uri, uri, len+1);

         uri += len + strspn(uri+len, AV_CAT_SEPARATOR);

@@ -114,10 +111,9 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags)

     if (err < 0)

         concat_close(h);

-    else if (!(nodes = av_realloc(nodes, data->length * sizeof(*nodes)))) {

+    else if ((err = av_reallocp(&nodes, data->length * sizeof(*nodes))) < 0)

         concat_close(h);

-        err = AVERROR(ENOMEM);

-    } else

+    else

         data->nodes = nodes;

     return err;

 }

@@ -331,16 +331,14 @@ static MMSSCPacketType get_tcp_server_response(MMSTContext *mmst)

             // if we successfully read everything.

             if(packet_id_type == mmst->header_packet_id) {

+                int err;

                 packet_type = SC_PKT_ASF_HEADER;

                 // Store the asf header

                 if(!mms->header_parsed) {

-                    void *p = av_realloc(mms->asf_header,

-                                  mms->asf_header_size + mms->remaining_in_len);

-                    if (!p) {

-                        av_freep(&mms->asf_header);

-                        return AVERROR(ENOMEM);

-                    }

-                    mms->asf_header = p;

+                    if ((err = av_reallocp(&mms->asf_header,

+                                           mms->asf_header_size +

+                                           mms->remaining_in_len)) < 0)

+                        return err;

                     memcpy(mms->asf_header + mms->asf_header_size,

                            mms->read_in_ptr, mms->remaining_in_len);

                     mms->asf_header_size += mms->remaining_in_len;

@@ -981,6 +981,7 @@ static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom,

     AVStream *st;

     uint64_t size;

     uint8_t *buf;

+    int err;

     if (c->fc->nb_streams < 1) // will happen with jp2 files

         return 0;

@@ -992,11 +993,9 @@ static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom,

     size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE;

     if (size > INT_MAX || (uint64_t)atom.size > INT_MAX)

         return AVERROR_INVALIDDATA;

-    buf= av_realloc(st->codec->extradata, size);

-    if (!buf)

-        return AVERROR(ENOMEM);

-    st->codec->extradata= buf;

-    buf+= st->codec->extradata_size;

+    if ((err = av_reallocp(&st->codec->extradata, size)) < 0)

+        return err;

+    buf = st->codec->extradata + st->codec->extradata_size;

     st->codec->extradata_size= size - FF_INPUT_BUFFER_PADDING_SIZE;

     AV_WB32(       buf    , atom.size + 8);

     AV_WL32(       buf + 4, atom.type);

@@ -104,12 +104,9 @@ static void sample_queue_push(HintSampleQueue *queue, uint8_t *data, int size,

     if (size <= 14)

         return;

     if (!queue->samples || queue->len >= queue->size) {

-        HintSample *samples;

         queue->size += 10;

-        samples = av_realloc(queue->samples, sizeof(HintSample)*queue->size);

-        if (!samples)

+        if (av_reallocp(&queue->samples, sizeof(*queue->samples) * queue->size) < 0)

             return;

-        queue->samples = samples;

     }

     queue->samples[queue->len].data = data;

     queue->samples[queue->len].size = size;

@@ -42,7 +42,7 @@ theora_header (AVFormatContext * s, int idx)

     struct ogg_stream *os = ogg->streams + idx;

     AVStream *st = s->streams[idx];

     struct theora_params *thp = os->private;

-    int cds = st->codec->extradata_size + os->psize + 2;

+    int cds = st->codec->extradata_size + os->psize + 2, err;

     uint8_t *cdp;

     if(!(os->buf[os->pstart] & 0x80))

@@ -123,8 +123,9 @@ theora_header (AVFormatContext * s, int idx)

         return -1;

     }

-    st->codec->extradata = av_realloc (st->codec->extradata,

-                                       cds + FF_INPUT_BUFFER_PADDING_SIZE);

+    if ((err = av_reallocp(&st->codec->extradata,

+                           cds + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)

+        return err;

     cdp = st->codec->extradata + st->codec->extradata_size;

     *cdp++ = os->psize >> 8;

     *cdp++ = os->psize & 0xff;

@@ -194,7 +194,8 @@ static unsigned int

 fixup_vorbis_headers(AVFormatContext * as, struct oggvorbis_private *priv,

                      uint8_t **buf)

 {

-    int i,offset, len, buf_len;

+    int i, offset, len, err;

+    int buf_len;

     unsigned char *ptr;

     len = priv->len[0] + priv->len[1] + priv->len[2];

@@ -213,7 +214,8 @@ fixup_vorbis_headers(AVFormatContext * as, struct oggvorbis_private *priv,

         offset += priv->len[i];

         av_freep(&priv->packet[i]);

     }

-    *buf = av_realloc(*buf, offset + FF_INPUT_BUFFER_PADDING_SIZE);

+    if ((err = av_reallocp(buf, offset + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)

+        return err;

     return offset;

 }

@@ -419,15 +419,14 @@ rdt_parse_sdp_line (AVFormatContext *s, int st_index,

         for (n = 0; n < s->nb_streams; n++)

             if (s->streams[n]->id == stream->id) {

-                int count = s->streams[n]->index + 1;

+                int count = s->streams[n]->index + 1, err;

                 if (first == -1) first = n;

                 if (rdt->nb_rmst < count) {

-                    RMStream **rmst= av_realloc(rdt->rmst, count*sizeof(*rmst));

-                    if (!rmst)

-                        return AVERROR(ENOMEM);

-                    memset(rmst + rdt->nb_rmst, 0,

-                           (count - rdt->nb_rmst) * sizeof(*rmst));

-                    rdt->rmst    = rmst;

+                    if ((err = av_reallocp(&rdt->rmst,

+                                           count * sizeof(*rdt->rmst))) < 0)

+                        return err;

+                    memset(rdt->rmst + rdt->nb_rmst, 0,

+                           (count - rdt->nb_rmst) * sizeof(*rdt->rmst));

                     rdt->nb_rmst = count;

                 }

                 rdt->rmst[s->streams[n]->index] = ff_rm_alloc_rmstream();

@@ -85,14 +85,12 @@ static int rtmp_http_send_cmd(URLContext *h, const char *cmd)

 static int rtmp_http_write(URLContext *h, const uint8_t *buf, int size)

 {

     RTMP_HTTPContext *rt = h->priv_data;

-    void *ptr;

     if (rt->out_size + size > rt->out_capacity) {

+        int err;

         rt->out_capacity = (rt->out_size + size) * 2;

-        ptr = av_realloc(rt->out_data, rt->out_capacity);

-        if (!ptr)

-            return AVERROR(ENOMEM);

-        rt->out_data = ptr;

+        if ((err = av_reallocp(&rt->out_data, rt->out_capacity)) < 0)

+            return err;

     }

     memcpy(rt->out_data + rt->out_size, buf, size);

@@ -150,15 +150,13 @@ static const uint8_t rtmp_server_key[] = {

 static int add_tracked_method(RTMPContext *rt, const char *name, int id)

 {

-    void *ptr;

+    int err;

     if (rt->nb_tracked_methods + 1 > rt->tracked_methods_size) {

         rt->tracked_methods_size = (rt->nb_tracked_methods + 1) * 2;

-        ptr = av_realloc(rt->tracked_methods,

-                         rt->tracked_methods_size * sizeof(*rt->tracked_methods));

-        if (!ptr)

-            return AVERROR(ENOMEM);

-        rt->tracked_methods = ptr;

+        if ((err = av_reallocp(&rt->tracked_methods, rt->tracked_methods_size *

+                               sizeof(*rt->tracked_methods))) < 0)

+            return err;

     }

     rt->tracked_methods[rt->nb_tracked_methods].name = av_strdup(name);

@@ -2063,7 +2061,6 @@ static int handle_invoke(URLContext *s, RTMPPacket *pkt)

 static int handle_notify(URLContext *s, RTMPPacket *pkt) {

     RTMPContext *rt  = s->priv_data;

     const uint8_t *p = NULL;

-    uint8_t *cp      = NULL;

     uint8_t commandbuffer[64];

     char statusmsg[128];

     int stringlen;

@@ -2098,25 +2095,22 @@ static int handle_notify(URLContext *s, RTMPPacket *pkt) {

         old_flv_size  = rt->flv_size;

         rt->flv_size += datatowritelength + 15;

     } else {

+        int err;

         old_flv_size = 0;

         rt->flv_size = datatowritelength + 15;

         rt->flv_off  = 0;

+        if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)

+            return err;

+        bytestream2_init_writer(&pbc, rt->flv_data, rt->flv_size);

+        bytestream2_skip_p(&pbc, old_flv_size);

+        bytestream2_put_byte(&pbc, pkt->type);

+        bytestream2_put_be24(&pbc, datatowritelength);

+        bytestream2_put_be24(&pbc, ts);

+        bytestream2_put_byte(&pbc, ts >> 24);

+        bytestream2_put_be24(&pbc, 0);

+        bytestream2_put_buffer(&pbc, datatowrite, datatowritelength);

+        bytestream2_put_be32(&pbc, 0);

     }

-

-    cp = av_realloc(rt->flv_data, rt->flv_size);

-    if (!cp)

-        return AVERROR(ENOMEM);

-    rt->flv_data = cp;

-    bytestream2_init_writer(&pbc, cp, rt->flv_size);

-    bytestream2_skip_p(&pbc, old_flv_size);

-    bytestream2_put_byte(&pbc, pkt->type);

-    bytestream2_put_be24(&pbc, datatowritelength);

-    bytestream2_put_be24(&pbc, ts);

-    bytestream2_put_byte(&pbc, ts >> 24);

-    bytestream2_put_be24(&pbc, 0);

-    bytestream2_put_buffer(&pbc, datatowrite, datatowritelength);

-    bytestream2_put_be32(&pbc, 0);

-

     return 0;

 }

@@ -2186,7 +2180,6 @@ static int get_packet(URLContext *s, int for_header)

 {

     RTMPContext *rt = s->priv_data;

     int ret;

-    uint8_t *p;

     const uint8_t *next;

     uint32_t size;

     uint32_t ts, cts, pts=0;

@@ -2250,19 +2243,21 @@ static int get_packet(URLContext *s, int for_header)

         if (rpkt.type == RTMP_PT_VIDEO || rpkt.type == RTMP_PT_AUDIO ||

            (rpkt.type == RTMP_PT_NOTIFY &&

             ff_amf_match_string(rpkt.data, rpkt.size, "onMetaData"))) {

+            int err;

             ts = rpkt.timestamp;

             // generate packet header and put data into buffer for FLV demuxer

             rt->flv_off  = 0;

             rt->flv_size = rpkt.size + 15;

-            rt->flv_data = p = av_realloc(rt->flv_data, rt->flv_size);

-            bytestream_put_byte(&p, rpkt.type);

-            bytestream_put_be24(&p, rpkt.size);

-            bytestream_put_be24(&p, ts);

-            bytestream_put_byte(&p, ts >> 24);

-            bytestream_put_be24(&p, 0);

-            bytestream_put_buffer(&p, rpkt.data, rpkt.size);

-            bytestream_put_be32(&p, 0);

+            if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)

+                return err;

+            bytestream_put_byte(&rt->flv_data, rpkt.type);

+            bytestream_put_be24(&rt->flv_data, rpkt.size);

+            bytestream_put_be24(&rt->flv_data, ts);

+            bytestream_put_byte(&rt->flv_data, ts >> 24);

+            bytestream_put_be24(&rt->flv_data, 0);

+            bytestream_put_buffer(&rt->flv_data, rpkt.data, rpkt.size);

+            bytestream_put_be32(&rt->flv_data, 0);

             ff_rtmp_packet_destroy(&rpkt);

             return 0;

         } else if (rpkt.type == RTMP_PT_NOTIFY) {

@@ -2274,10 +2269,13 @@ static int get_packet(URLContext *s, int for_header)

             }

             return 0;

         } else if (rpkt.type == RTMP_PT_METADATA) {

+            int err;

+            uint8_t *p;

             // we got raw FLV data, make it available for FLV demuxer

             rt->flv_off  = 0;

             rt->flv_size = rpkt.size;

-            rt->flv_data = av_realloc(rt->flv_data, rt->flv_size);

+            if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)

+                return err;

             /* rewrite timestamps */

             next = rpkt.data;

             ts = rpkt.timestamp;

@@ -2550,9 +2548,11 @@ reconnect:

     }

     if (rt->is_input) {

+        int err;

         // generate FLV header for demuxer

         rt->flv_size = 13;

-        rt->flv_data = av_realloc(rt->flv_data, rt->flv_size);

+        if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)

+            return err;

         rt->flv_off  = 0;

         memcpy(rt->flv_data, "FLV\1\5\0\0\0\011\0\0\0\0", rt->flv_size);

     } else {

@@ -239,14 +239,11 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,

                 int cur_len = start_off + len_off - off;

                 int prev_len = out_len;

-                void *newmem;

                 out_len += cur_len;

                 if (FFMIN(cur_len, len - off) < 0)

                     return -1;

-                newmem = av_realloc(asf->buf, out_len);

-                if (!newmem)

-                    return -1;

-                asf->buf = newmem;

+                if ((res = av_reallocp(&asf->buf, out_len)) < 0)

+                    return res;

                 memcpy(asf->buf + prev_len, buf + off,

                        FFMIN(cur_len, len - off));

                 avio_skip(pb, cur_len);

@@ -172,8 +172,10 @@ static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,

     switch (packing_scheme) {

     case 3: /* one data packet spread over 1 or multiple RTP packets */

         if (qt->pkt.size > 0 && qt->timestamp == *timestamp) {

-            qt->pkt.data = av_realloc(qt->pkt.data, qt->pkt.size + alen +

-                                      FF_INPUT_BUFFER_PADDING_SIZE);

+            int err;

+            if ((err = av_reallocp(&qt->pkt.data, qt->pkt.size + alen +

+                                   FF_INPUT_BUFFER_PADDING_SIZE)) < 0)

+                return err;

         } else {

             av_freep(&qt->pkt.data);

             av_init_packet(&qt->pkt);

@@ -181,8 +183,6 @@ static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,

             qt->pkt.size = 0;

             qt->timestamp = *timestamp;

         }

-        if (!qt->pkt.data)

-            return AVERROR(ENOMEM);

         memcpy(qt->pkt.data + qt->pkt.size, buf + avio_tell(&pb), alen);

         qt->pkt.size += alen;

         if (has_marker_bit) {

@@ -314,7 +314,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)

         for(i = 0; i < 7; i++) {

             if(flags & 1) {

                 uint32_t size;

-                uint8_t *tmpbuf;

+                int err;

                 size = avio_rl32(s->pb) - 4;

                 if (!size || size + 4L > frame_size) {

@@ -324,10 +324,8 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)

                 frame_size -= size;

                 frame_size -= 4;

                 smk->curstream++;

-                tmpbuf = av_realloc(smk->bufs[smk->curstream], size);

-                if (!tmpbuf)

-                    return AVERROR(ENOMEM);

-                smk->bufs[smk->curstream] = tmpbuf;

+                if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)

+                    return err;

                 smk->buf_sizes[smk->curstream] = size;

                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);

                 if(ret != size)

@@ -453,12 +453,13 @@ fail:

 static int add_fragment(OutputStream *os, const char *file, const char *infofile, int64_t start_time, int64_t duration, int64_t start_pos, int64_t size)

 {

+    int err;

     Fragment *frag;

     if (os->nb_fragments >= os->fragments_size) {

         os->fragments_size = (os->fragments_size + 1) * 2;

-        os->fragments = av_realloc(os->fragments, sizeof(*os->fragments)*os->fragments_size);

-        if (!os->fragments)

-            return AVERROR(ENOMEM);

+        if ((err = av_reallocp(&os->fragments, sizeof(*os->fragments) *

+                               os->fragments_size)) < 0)

+            return err;

     }

     frag = av_mallocz(sizeof(*frag));

     if (!frag)

@@ -355,12 +355,8 @@ int av_probe_input_buffer2(AVIOContext *pb, AVInputFormat **fmt,

         score = probe_size < max_probe_size ? AVPROBE_SCORE_RETRY : 0;

         /* read probe data */

-        buftmp = av_realloc(buf, probe_size + AVPROBE_PADDING_SIZE);

-        if(!buftmp){

-            av_free(buf);

-            return AVERROR(ENOMEM);

-        }

-        buf=buftmp;

+        if ((ret = av_reallocp(&buf, probe_size + AVPROBE_PADDING_SIZE)) < 0)

+            return ret;

         if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) {

             /* fail if error was not end of file, otherwise, lower score */

             if (ret != AVERROR_EOF) {