Browse code

rmdec: fix null derefercne

Fixes CID733714
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2012/10/26 23:18:09
Showing 1 changed files
... ...
@@ -839,7 +839,8 @@ ff_rm_retrieve_cache (AVFormatContext *s, AVIOContext *pb,
839 839
         ast->deint_id == DEINT_ID_VBRS)
840 840
         av_get_packet(pb, pkt, ast->sub_packet_lengths[ast->sub_packet_cnt - rm->audio_pkt_cnt]);
841 841
     else {
842
-        av_new_packet(pkt, st->codec->block_align);
842
+        if(av_new_packet(pkt, st->codec->block_align) < 0)
843
+            return AVERROR(ENOMEM);
843 844
         memcpy(pkt->data, ast->pkt.data + st->codec->block_align * //FIXME avoid this
844 845
                (ast->sub_packet_h * ast->audio_framesize / st->codec->block_align - rm->audio_pkt_cnt),
845 846
                st->codec->block_align);
... ...
@@ -867,7 +868,9 @@ static int rm_read_packet(AVFormatContext *s, AVPacket *pkt)
867 867
         if (rm->audio_pkt_cnt) {
868 868
             // If there are queued audio packet return them first
869 869
             st = s->streams[rm->audio_stream_num];
870
-            ff_rm_retrieve_cache(s, s->pb, st, st->priv_data, pkt);
870
+            res = ff_rm_retrieve_cache(s, s->pb, st, st->priv_data, pkt);
871
+            if(res < 0)
872
+                return res;
871 873
             flags = 0;
872 874
         } else {
873 875
             if (rm->old_format) {