avcodec/hevc/refs: Check multiplication in alloc_frame()

Fixes: integer overflow on 32bit
2026-05-01 19:48:16 +02:00
parent 89e128224e
commit fd5023053a
1 changed files with 4 additions and 1 deletions
@@ -162,7 +162,10 @@ static HEVCFrame *alloc_frame(HEVCContext *s, HEVCLayerContext *l)
        if (ret < 0)
            goto fail;

-        frame->rpl = av_refstruct_allocz(s->pkt.nb_nals * sizeof(*frame->rpl));
+        size_t rpl_bytes;
+        if (av_size_mult(s->pkt.nb_nals, sizeof(*frame->rpl), &rpl_bytes) < 0)
+            goto fail;
+        frame->rpl = av_refstruct_allocz(rpl_bytes);
        if (!frame->rpl)
            goto fail;
        frame->nb_rpl_elems = s->pkt.nb_nals;