From b668d243e0201835e90ce47a642880c39d5c76be Mon Sep 17 00:00:00 2001
From: jbr <jbr@9553f0bf-9b14-0410-a0b8-cfaf0461ba5b>
Date: Thu, 12 Feb 2009 21:39:37 +0000
Subject: [PATCH] use av_malloc() in vorbis_comment()

git-svn-id: file:///var/local/repositories/ffmpeg/trunk@17188 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
---
 libavformat/oggparsevorbis.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
index a74fb9a9f..7c97807c0 100644
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -71,8 +71,16 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
         v++;
 
         if (tl && vl) {
-            char tt[tl + 1];
-            char ct[vl + 1];
+            char *tt, *ct;
+
+            tt = av_malloc(tl + 1);
+            ct = av_malloc(vl + 1);
+            if (!tt || !ct) {
+                av_freep(&tt);
+                av_freep(&ct);
+                av_log(as, AV_LOG_WARNING, "out-of-memory error. skipping VorbisComment tag.\n");
+                continue;
+            }
 
             for (j = 0; j < tl; j++)
                 tt[j] = toupper(t[j]);
@@ -82,6 +90,9 @@ vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
             ct[vl] = 0;
 
             av_metadata_set(&as->metadata, tt, ct);
+
+            av_freep(&tt);
+            av_freep(&ct);
         }
     }
 
-- 
2.39.2