Unified · Split
| @@ -56,12 +56,18 @@ struct FFHashtableContext { · 55 unmodified lines | ||
| 56 | 56 | |
| 57 | 57 | int ff_hashtable_alloc(struct FFHashtableContext **ctx, size_t key_size, size_t val_size, size_t max_entries) |
| 58 | 58 | { |
| 59 | + const size_t keyval_size = key_size + val_size; | |
| 60 | + | |
| 61 | + if (keyval_size < key_size || // did (unsigned,defined) wraparound happen? | |
| 62 | + keyval_size > SIZE_MAX - sizeof(size_t) - (ALIGN - 1)) | |
| 63 | + return AVERROR(ERANGE); | |
| 64 | + | |
| 59 | 65 | FFHashtableContext *res = av_mallocz(sizeof(*res)); |
| 60 | 66 | if (!res) |
| 61 | 67 | return AVERROR(ENOMEM); |
| 62 | 68 | res->key_size = key_size; |
| 63 | 69 | res->val_size = val_size; |
| 64 | − res->entry_size = FFALIGN(sizeof(size_t) + key_size + val_size, ALIGN); | |
| 70 | + res->entry_size = FFALIGN(sizeof(size_t) + keyval_size, ALIGN); | |
| 65 | 71 | res->max_entries = max_entries; |
| 66 | 72 | res->nb_entries = 0; |
| 67 | 73 | res->crc = av_crc_get_table(AV_CRC_32_IEEE); |