From b4800b8b7dfba22117d8edd02164b00c83ae3753 Mon Sep 17 00:00:00 2001
From: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Date: Sat, 21 Mar 2009 00:50:51 +0000
Subject: [PATCH] protect realloc overflow

Originally committed as revision 18088 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/mxfdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 3933d4c87e..73b0a77d2b 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -364,6 +364,8 @@ static int mxf_read_primer_pack(MXFContext *mxf)
 
 static int mxf_add_metadata_set(MXFContext *mxf, void *metadata_set)
 {
+    if (mxf->metadata_sets_count+1 >= UINT_MAX / sizeof(*mxf->metadata_sets))
+        return AVERROR(ENOMEM);
     mxf->metadata_sets = av_realloc(mxf->metadata_sets, (mxf->metadata_sets_count + 1) * sizeof(*mxf->metadata_sets));
     if (!mxf->metadata_sets)
         return -1;