@@ -2930,7 +2930,7 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,

                                    struct in_addr my_ip)

 {

     AVFormatContext *avc;

-    AVStream avs[MAX_STREAMS];

+    AVStream *avs = NULL;

     int i;

     avc =  avformat_alloc_context();

@@ -2948,14 +2948,29 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,

         snprintf(avc->filename, 1024, "rtp://0.0.0.0");

     }

+#if !FF_API_MAX_STREAMS

+    if (avc->nb_streams >= INT_MAX/sizeof(*avc->streams) ||

+        !(avc->streams = av_malloc(avc->nb_streams * sizeof(*avc->streams))))

+        goto sdp_done;

+#endif

+    if (avc->nb_streams >= INT_MAX/sizeof(*avs) ||

+        !(avs = av_malloc(avc->nb_streams * sizeof(*avs))))

+        goto sdp_done;

+

     for(i = 0; i < stream->nb_streams; i++) {

         avc->streams[i] = &avs[i];

         avc->streams[i]->codec = stream->streams[i]->codec;

     }

     *pbuffer = av_mallocz(2048);

     avf_sdp_create(&avc, 1, *pbuffer, 2048);

+

+ sdp_done:

+#if !FF_API_MAX_STREAMS

+    av_free(avc->streams);

+#endif

     av_metadata_free(&avc->metadata);

     av_free(avc);

+    av_free(avs);

     return strlen(*pbuffer);

 }