From e3b446498aaccef706d808ba7cd1da58047bc376 Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Thu, 12 Feb 2009 21:39:37 +0000
Subject: [PATCH] use av_malloc() in vorbis_comment()

Originally committed as revision 17188 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/oggparsevorbis.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
index a74fb9a9ff..7c97807c01 100644
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -71,8 +71,16 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
         v++;
 
         if (tl && vl) {
-            char tt[tl + 1];
-            char ct[vl + 1];
+            char *tt, *ct;
+
+            tt = av_malloc(tl + 1);
+            ct = av_malloc(vl + 1);
+            if (!tt || !ct) {
+                av_freep(&tt);
+                av_freep(&ct);
+                av_log(as, AV_LOG_WARNING, "out-of-memory error. skipping VorbisComment tag.\n");
+                continue;
+            }
 
             for (j = 0; j < tl; j++)
                 tt[j] = toupper(t[j]);
@@ -82,6 +90,9 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
             ct[vl] = 0;
 
             av_metadata_set(&as->metadata, tt, ct);
+
+            av_freep(&tt);
+            av_freep(&ct);
         }
     }