[PR] libavcodec, libavformat: use overflow-checked allocation wrappers (PR #23892)

Thalha Ahmed via ffmpeg-devel <[email protected]> Fri, 24 Jul 2026 12:11:37 -0000
Newsgroups gmane.comp.video.ffmpeg.devel
Message-ID <178489509772.59.11722561488393569962@29965ddac10e>
PR #23892 opened by Thalha Ahmed (thalha-a9)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23892
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23892.patch

This patch migrates 93 allocation call sites across 38 files from unchecked
av_malloc(a * b) / av_mallocz(a * b) to the overflow-checked
av_malloc_array(a, b) / av_calloc(a, b) wrappers.

Many decoders and demuxers compute allocation sizes by multiplying values
parsed from input files (width, height, mb_stride, nb_entries,
coupling_steps, etc.). If the multiplication overflows, a small buffer is
allocated while the subsequent code writes the full amount, causing a heap
buffer overflow.

av_malloc_array() and av_calloc() validate that the multiplication does not
overflow before allocating memory. All affected sites already check for NULL
returns, so this is a safe mechanical replacement with no functional change
for legitimate inputs.

38 files changed, 93 insertions, 93 deletions

Signedoff by: Thalha Ahmed <[email protected]>


>From 0d628bd8b5df2ba491486aa6ad4656f1f1c0cb44 Mon Sep 17 00:00:00 2001
From: Thalha Ahmed <[email protected]>
Date: Fri, 24 Jul 2026 17:27:17 +0530
Subject: [PATCH] libavcodec, libavformat: use overflow-checked allocation
 wrappers

Replace unchecked av_malloc(a * b) with av_malloc_array(a, b) and
av_mallocz(a * b) with av_calloc(a, b) across 38 files in libavcodec
and libavformat.

When processing untrusted media files, allocation sizes are computed
from attacker-controlled values (width, height, mb_stride, nb_entries,
etc.). If the multiplication overflows, av_malloc() allocates a small
buffer while subsequent code writes the full (untruncated) amount,
causing heap buffer overflow.

av_malloc_array() and av_calloc() check for overflow before
multiplying, returning NULL on overflow. All affected call sites
already handle NULL returns via existing ENOMEM error paths, so this
is a safe mechanical replacement with no functional change for
legitimate inputs.

Signed-off-by: Thalha Ahmed <[email protected]>
---
 libavcodec/4xm.c          |  4 ++--
 libavcodec/cinepakenc.c   |  2 +-
 libavcodec/cuviddec.c     |  2 +-
 libavcodec/dvdsubdec.c    |  4 ++--
 libavcodec/escape130.c    |  6 +++---
 libavcodec/hnm4video.c    |  6 +++---
 libavcodec/huffyuvenc.c   |  2 +-
 libavcodec/iff.c          |  6 +++---
 libavcodec/ivi.c          |  2 +-
 libavcodec/jpeg2000dec.c  |  2 +-
 libavcodec/kgv1dec.c      |  4 ++--
 libavcodec/magicyuvenc.c  |  2 +-
 libavcodec/mss2.c         |  4 ++--
 libavcodec/msvideo1enc.c  |  2 +-
 libavcodec/nvenc.c        |  2 +-
 libavcodec/ratecontrol.c  |  2 +-
 libavcodec/rl2.c          |  2 +-
 libavcodec/rv34.c         | 12 ++++++------
 libavcodec/sgienc.c       |  2 +-
 libavcodec/svq1enc.c      | 12 ++++++------
 libavcodec/svq3.c         |  4 ++--
 libavcodec/tiff.c         |  2 +-
 libavcodec/tscc2.c        |  2 +-
 libavcodec/utvideoenc.c   |  2 +-
 libavcodec/v4l2_context.c |  2 +-
 libavcodec/vb.c           |  4 ++--
 libavcodec/vc1dec.c       | 30 +++++++++++++++---------------
 libavcodec/vc2enc.c       |  2 +-
 libavcodec/vorbisdec.c    | 18 +++++++++---------
 libavcodec/vp8.c          | 14 +++++++-------
 libavcodec/vqcdec.c       |  2 +-
 libavcodec/xsubdec.c      |  2 +-
 libavformat/dashenc.c     |  2 +-
 libavformat/demux.c       |  2 +-
 libavformat/flvdec.c      |  2 +-
 libavformat/hlsenc.c      | 10 +++++-----
 libavformat/jvdec.c       |  4 ++--
 libavformat/mov.c         |  2 +-
 38 files changed, 93 insertions(+), 93 deletions(-)

diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index c6b2ce1230..6da4b89b51 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -1014,8 +1014,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
     if (ret < 0)
         return ret;
 
-    f->frame_buffer      = av_mallocz(avctx->width * avctx->height * 2);
-    f->last_frame_buffer = av_mallocz(avctx->width * avctx->height * 2);
+    f->frame_buffer      = av_calloc(avctx->width * (size_t)avctx->height, 2);
+    f->last_frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2);
     if (!f->frame_buffer || !f->last_frame_buffer)
         return AVERROR(ENOMEM);
 
diff --git a/libavcodec/cinepakenc.c b/libavcodec/cinepakenc.c
index 104a9f485e..0c170ccf29 100644
--- a/libavcodec/cinepakenc.c
+++ b/libavcodec/cinepakenc.c
@@ -186,7 +186,7 @@ static av_cold int cinepak_encode_init(AVCodecContext *avctx)
         return AVERROR(ENOMEM);
 
     for (x = 0; x < (avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 4 : 3); x++)
-        if (!(s->pict_bufs[x] = av_malloc((avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 6 : 4) * (avctx->width * avctx->height) >> 2)))
+        if (!(s->pict_bufs[x] = av_malloc_array((avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 6 : 4), (size_t)avctx->width * avctx->height >> 2)))
             return AVERROR(ENOMEM);
 
     mb_count = avctx->width * avctx->height / MB_AREA;
diff --git a/libavcodec/cuviddec.c b/libavcodec/cuviddec.c
index 3c8faae3c8..32da57440a 100644
--- a/libavcodec/cuviddec.c
+++ b/libavcodec/cuviddec.c
@@ -1641,7 +1641,7 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx)
 
     ctx->cuparseinfo.pExtVideoInfo = ctx->cuparse_ext;
 
-    ctx->key_frame = av_mallocz(ctx->nb_surfaces * sizeof(int));
+    ctx->key_frame = av_calloc(ctx->nb_surfaces, sizeof(int));
     if (!ctx->key_frame) {
         ret = AVERROR(ENOMEM);
         goto error;
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index 9f9845bf8e..baa2536bc3 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -378,7 +378,7 @@ static int decode_dvd_subtitles(void *logctx, DVDSubContext *ctx,
                 if (!sub_header->rects[0])
                     goto fail;
                 sub_header->num_rects = 1;
-                bitmap = sub_header->rects[0]->data[0] = av_malloc(w * h);
+                bitmap = sub_header->rects[0]->data[0] = av_malloc_array(w, h);
                 if (!bitmap)
                     goto fail;
                 if (decode_rle(bitmap, w * 2, w, (h + 1) / 2, ctx->used_color,
@@ -481,7 +481,7 @@ static int find_smallest_bounding_rectangle(DVDSubContext *ctx, AVSubtitle *s)
         x2--;
     w = x2 - x1 + 1;
     h = y2 - y1 + 1;
-    bitmap = av_malloc(w * h);
+    bitmap = av_malloc_array(w, h);
     if (!bitmap)
         return 1;
     for(y = 0; y < h; y++) {
diff --git a/libavcodec/escape130.c b/libavcodec/escape130.c
index a192831144..8032f6f4fb 100644
--- a/libavcodec/escape130.c
+++ b/libavcodec/escape130.c
@@ -125,9 +125,9 @@ static av_cold int escape130_decode_init(AVCodecContext *avctx)
         return AVERROR_INVALIDDATA;
     }
 
-    s->old_y_avg = av_mallocz(avctx->width * avctx->height / 4);
-    s->buf1      = av_malloc(avctx->width * avctx->height * 3 / 2);
-    s->buf2      = av_malloc(avctx->width * avctx->height * 3 / 2);
+    s->old_y_avg = av_calloc(avctx->width / 2, avctx->height / 2);
+    s->buf1      = av_malloc_array(avctx->width * (size_t)3, avctx->height / 2);
+    s->buf2      = av_malloc_array(avctx->width * (size_t)3, avctx->height / 2);
     if (!s->old_y_avg || !s->buf1 || !s->buf2) {
         av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\n");
         return AVERROR(ENOMEM);
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c
index 51e75789d2..c149a10226 100644
--- a/libavcodec/hnm4video.c
+++ b/libavcodec/hnm4video.c
@@ -471,9 +471,9 @@ static av_cold int hnm_decode_init(AVCodecContext *avctx)
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
     hnm->width     = avctx->width;
     hnm->height    = avctx->height;
-    hnm->buffer1   = av_mallocz(avctx->width * avctx->height);
-    hnm->buffer2   = av_mallocz(avctx->width * avctx->height);
-    hnm->processed = av_mallocz(avctx->width * avctx->height);
+    hnm->buffer1   = av_calloc(avctx->width, avctx->height);
+    hnm->buffer2   = av_calloc(avctx->width, avctx->height);
+    hnm->processed = av_calloc(avctx->width, avctx->height);
 
     if (!hnm->buffer1 || !hnm->buffer2 || !hnm->processed) {
         av_log(avctx, AV_LOG_ERROR, "av_mallocz() failed\n");
diff --git a/libavcodec/huffyuvenc.c b/libavcodec/huffyuvenc.c
index dd3ed9a996..d9c574fb77 100644
--- a/libavcodec/huffyuvenc.c
+++ b/libavcodec/huffyuvenc.c
@@ -437,7 +437,7 @@ static av_cold int encode_init(AVCodecContext *avctx)
     s->picture_number=0;
 
     for (int i = 0; i < 3; i++) {
-        s->temp[i] = av_malloc(4 * avctx->width + 16);
+        s->temp[i] = av_malloc(4 * (size_t)avctx->width + 16);
         if (!s->temp[i])
             return AVERROR(ENOMEM);
     }
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 66839c3c39..25444c4704 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -251,7 +251,7 @@ static int extract_header(AVCodecContext *const avctx,
                 av_log(avctx, AV_LOG_ERROR, "bpp %d too large for palette\n", s->bpp);
                 return AVERROR(ENOMEM);
             }
-            s->mask_buf = av_malloc((s->planesize * 32) + AV_INPUT_BUFFER_PADDING_SIZE);
+            s->mask_buf = av_malloc(s->planesize * (size_t)32 + AV_INPUT_BUFFER_PADDING_SIZE);
             if (!s->mask_buf)
                 return AVERROR(ENOMEM);
             s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + AV_INPUT_BUFFER_PADDING_SIZE);
@@ -279,7 +279,7 @@ static int extract_header(AVCodecContext *const avctx,
         if (avctx->codec_tag == MKTAG('P', 'B', 'M', ' ') && s->ham == 4)
             extra_space = 4;
 
-        s->ham_buf = av_mallocz((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE);
+        s->ham_buf = av_mallocz(s->planesize * (size_t)8 + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!s->ham_buf)
             return AVERROR(ENOMEM);
 
@@ -371,7 +371,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
     if ((err = av_image_check_size(avctx->width, avctx->height, 0, avctx)))
         return err;
     s->planesize = FFALIGN(avctx->width, 16) >> 3; // Align plane size in bits to word-boundary
-    s->planebuf  = av_malloc(s->planesize * avctx->height + AV_INPUT_BUFFER_PADDING_SIZE);
+    s->planebuf  = av_malloc(s->planesize * (size_t)avctx->height + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!s->planebuf)
         return AVERROR(ENOMEM);
 
diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c
index a38f382d5f..a3fc64ba54 100644
--- a/libavcodec/ivi.c
+++ b/libavcodec/ivi.c
@@ -927,7 +927,7 @@ static void *prepare_buf(IVI45DecContext *ctx, IVIBandDesc *band, int i)
     if (ctx->pic_conf.luma_bands <= 1 && i == 2)
         return NULL;
     if (!band->bufs[i])
-        band->bufs[i] = av_mallocz(2 * band->bufsize);
+        band->bufs[i] = av_calloc(band->bufsize, 2);
     return band->bufs[i];
 }
 
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 369377e4fc..4827def0a9 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -330,7 +330,7 @@ static int get_siz(Jpeg2000DecoderContext *s)
     for (i = 0; i < s->numXtiles * s->numYtiles; i++) {
         Jpeg2000Tile *tile = s->tile + i;
 
-        tile->comp = av_mallocz(s->ncomponents * sizeof(*tile->comp));
+        tile->comp = av_calloc(s->ncomponents, sizeof(*tile->comp));
         if (!tile->comp)
             return AVERROR(ENOMEM);
     }
diff --git a/libavcodec/kgv1dec.c b/libavcodec/kgv1dec.c
index bdc5a16259..9422f6f5ed 100644
--- a/libavcodec/kgv1dec.c
+++ b/libavcodec/kgv1dec.c
@@ -74,8 +74,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
     }
 
     if (!c->frame_buffer) {
-        c->frame_buffer      = av_mallocz(avctx->width * avctx->height * 2);
-        c->last_frame_buffer = av_mallocz(avctx->width * avctx->height * 2);
+        c->frame_buffer      = av_calloc(avctx->width * (size_t)avctx->height, 2);
+        c->last_frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2);
         if (!c->frame_buffer || !c->last_frame_buffer) {
             decode_flush(avctx);
             return AVERROR(ENOMEM);
diff --git a/libavcodec/magicyuvenc.c b/libavcodec/magicyuvenc.c
index 80a54638bc..15d3058ea6 100644
--- a/libavcodec/magicyuvenc.c
+++ b/libavcodec/magicyuvenc.c
@@ -231,7 +231,7 @@ static av_cold int magy_encode_init(AVCodecContext *avctx)
             sl->height = AV_CEIL_RSHIFT(sl->height, s->vshift[i]);
             sl->width  = AV_CEIL_RSHIFT(avctx->width, s->hshift[i]);
 
-            sl->slice = av_malloc(avctx->width * (s->slice_height + 2) +
+            sl->slice = av_malloc((size_t)avctx->width * (s->slice_height + 2) +
                                                      AV_INPUT_BUFFER_PADDING_SIZE);
             if (!sl->slice)
                 return AVERROR(ENOMEM);
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index aaeceb055d..36009f5782 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -884,8 +884,8 @@ static av_cold int mss2_decode_init(AVCodecContext *avctx)
         return ret;
     ctx->last_pic   = av_frame_alloc();
     c->pal_stride   = c->mask_stride;
-    c->pal_pic      = av_mallocz(c->pal_stride * avctx->height);
-    c->last_pal_pic = av_mallocz(c->pal_stride * avctx->height);
+    c->pal_pic      = av_calloc(c->pal_stride, avctx->height);
+    c->last_pal_pic = av_calloc(c->pal_stride, avctx->height);
     if (!c->pal_pic || !c->last_pal_pic || !ctx->last_pic)
         return AVERROR(ENOMEM);
     if (ret = wmv9_init(avctx))
diff --git a/libavcodec/msvideo1enc.c b/libavcodec/msvideo1enc.c
index b1cae72081..86b373b0f5 100644
--- a/libavcodec/msvideo1enc.c
+++ b/libavcodec/msvideo1enc.c
@@ -84,7 +84,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     dst= buf= pkt->data;
 
     if(!c->prev)
-        c->prev = av_malloc(avctx->width * 3 * (avctx->height + 3));
+        c->prev = av_malloc_array(avctx->width * (size_t)3, avctx->height + 3);
     if (!c->prev)
         return AVERROR(ENOMEM);
     prevptr = c->prev + avctx->width * 3 * (FFALIGN(avctx->height, 4) - 1);
diff --git a/libavcodec/nvenc.c b/libavcodec/nvenc.c
index dffbb67652..0c41846a26 100644
--- a/libavcodec/nvenc.c
+++ b/libavcodec/nvenc.c
@@ -405,7 +405,7 @@ static int nvenc_check_codec_support(AVCodecContext *avctx)
     if (ret != NV_ENC_SUCCESS || !count)
         return AVERROR(ENOSYS);
 
-    guids = av_malloc(count * sizeof(GUID));
+    guids = av_malloc_array(count, sizeof(GUID));
     if (!guids)
         return AVERROR(ENOMEM);
 
diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index d48ede909c..f61a2de874 100644
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -577,7 +577,7 @@ av_cold int ff_rate_control_init(MPVMainEncContext *const m)
         i += m->max_b_frames;
         if (i <= 0 || i >= INT_MAX / sizeof(RateControlEntry))
             return -1;
-        rcc->entry       = av_mallocz(i * sizeof(RateControlEntry));
+        rcc->entry       = av_calloc(i, sizeof(RateControlEntry));
         if (!rcc->entry)
             return AVERROR(ENOMEM);
         rcc->num_entries = i;
diff --git a/libavcodec/rl2.c b/libavcodec/rl2.c
index e427a27dce..e15750b370 100644
--- a/libavcodec/rl2.c
+++ b/libavcodec/rl2.c
@@ -184,7 +184,7 @@ static av_cold int rl2_decode_init(AVCodecContext *avctx)
     if (back_size > 0) {
         /* The 254 are padding to ensure that pointer arithmetic stays within
          * the buffer. */
-        uint8_t *back_frame = av_mallocz(avctx->width * avctx->height + 254);
+        uint8_t *back_frame = av_mallocz(avctx->width * (size_t)avctx->height + 254);
         if (!back_frame)
             return AVERROR(ENOMEM);
         rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size,
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index dd5ee05eba..bde0eedc4d 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1403,15 +1403,15 @@ static int rv34_decoder_alloc(RV34DecContext *r)
 {
     r->intra_types_stride = r->s.mb_width * 4 + 4;
 
-    r->cbp_chroma       = av_mallocz(r->s.mb_stride * r->s.mb_height *
+    r->cbp_chroma       = av_calloc((size_t)r->s.mb_stride * r->s.mb_height,
                                     sizeof(*r->cbp_chroma));
-    r->cbp_luma         = av_mallocz(r->s.mb_stride * r->s.mb_height *
+    r->cbp_luma         = av_calloc((size_t)r->s.mb_stride * r->s.mb_height,
                                     sizeof(*r->cbp_luma));
-    r->deblock_coefs    = av_mallocz(r->s.mb_stride * r->s.mb_height *
+    r->deblock_coefs    = av_calloc((size_t)r->s.mb_stride * r->s.mb_height,
                                     sizeof(*r->deblock_coefs));
-    r->intra_types_hist = av_malloc(r->intra_types_stride * 4 * 2 *
+    r->intra_types_hist = av_malloc_array((size_t)r->intra_types_stride * 4 * 2,
                                     sizeof(*r->intra_types_hist));
-    r->mb_type          = av_mallocz(r->s.mb_stride * r->s.mb_height *
+    r->mb_type          = av_calloc((size_t)r->s.mb_stride * r->s.mb_height,
                                      sizeof(*r->mb_type));
 
     if (!(r->cbp_chroma       && r->cbp_luma && r->deblock_coefs &&
@@ -1721,7 +1721,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, AVFrame *pict,
         if (!r->tmp_b_block_base) {
             int i;
 
-            r->tmp_b_block_base = av_malloc(s->linesize * 48);
+            r->tmp_b_block_base = av_malloc_array(s->linesize, 48);
             if (!r->tmp_b_block_base)
                 return AVERROR(ENOMEM);
             for (i = 0; i < 2; i++)
diff --git a/libavcodec/sgienc.c b/libavcodec/sgienc.c
index a6ec443970..c27a97eaa2 100644
--- a/libavcodec/sgienc.c
+++ b/libavcodec/sgienc.c
@@ -201,7 +201,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
         bytestream2_skip_p(&pbc, tablesize);
 
         /* Make an intermediate consecutive buffer. */
-        if (!(encode_buf = av_malloc(width * bytes_per_channel)))
+        if (!(encode_buf = av_malloc_array(width, bytes_per_channel)))
             return AVERROR(ENOMEM);
 
         for (z = 0; z < depth; z++) {
diff --git a/libavcodec/svq1enc.c b/libavcodec/svq1enc.c
index 4855bed188..c2224a4bb9 100644
--- a/libavcodec/svq1enc.c
+++ b/libavcodec/svq1enc.c
@@ -605,12 +605,12 @@ static av_cold int svq1_encode_init(AVCodecContext *avctx)
 
     s->m.c.picture_structure = PICT_FRAME;
     s->m.me.temp           =
-    s->m.me.scratchpad     = av_mallocz((avctx->width + 64) *
-                                        2 * 16 * 2 * sizeof(uint8_t));
-    s->mb_type             = av_mallocz((s->y_block_width + 1) *
-                                        s->y_block_height * sizeof(int16_t));
-    s->dummy               = av_mallocz((s->y_block_width + 1) *
-                                        s->y_block_height * sizeof(int32_t));
+    s->m.me.scratchpad     = av_calloc((size_t)(avctx->width + 64) *
+                                        2 * 16 * 2, sizeof(uint8_t));
+    s->mb_type             = av_calloc((size_t)(s->y_block_width + 1) *
+                                        s->y_block_height, sizeof(int16_t));
+    s->dummy               = av_calloc((size_t)(s->y_block_width + 1) *
+                                        s->y_block_height, sizeof(int32_t));
     s->m.new_pic       = av_frame_alloc();
 
     if (!s->m.me.scratchpad ||
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 296e81f322..03b2bcf43e 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1332,11 +1332,11 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
         }
     }
 
-    s->intra4x4_pred_mode = av_mallocz(s->mb_stride * 2 * 8);
+    s->intra4x4_pred_mode = av_calloc((size_t)s->mb_stride * 2, 8);
     if (!s->intra4x4_pred_mode)
         return AVERROR(ENOMEM);
 
-    s->mb2br_xy = av_mallocz(s->mb_stride * (s->mb_height + 1) *
+    s->mb2br_xy = av_calloc((size_t)s->mb_stride * (s->mb_height + 1),
                              sizeof(*s->mb2br_xy));
     if (!s->mb2br_xy)
         return AVERROR(ENOMEM);
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 8a179f0fd0..bd7c17e77f 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -2202,7 +2202,7 @@ again:
             s->avctx->pix_fmt == AV_PIX_FMT_RGBA) {
             stride = stride * 5 / 4;
             five_planes =
-            dst = av_malloc(stride * s->height);
+            dst = av_malloc_array(stride, s->height);
             if (!dst)
                 return AVERROR(ENOMEM);
         }
diff --git a/libavcodec/tscc2.c b/libavcodec/tscc2.c
index cfe5a6e752..0797ae2647 100644
--- a/libavcodec/tscc2.c
+++ b/libavcodec/tscc2.c
@@ -342,7 +342,7 @@ static av_cold int tscc2_decode_init(AVCodecContext *avctx)
 
     c->mb_width     = FFALIGN(avctx->width,  16) >> 4;
     c->mb_height    = FFALIGN(avctx->height,  8) >> 3;
-    c->slice_quants = av_malloc(c->mb_width * c->mb_height);
+    c->slice_quants = av_malloc_array(c->mb_width, c->mb_height);
     if (!c->slice_quants) {
         av_log(avctx, AV_LOG_ERROR, "Cannot allocate slice information\n");
         return AVERROR(ENOMEM);
diff --git a/libavcodec/utvideoenc.c b/libavcodec/utvideoenc.c
index 7cefca79bc..4dc95a79aa 100644
--- a/libavcodec/utvideoenc.c
+++ b/libavcodec/utvideoenc.c
@@ -187,7 +187,7 @@ static av_cold int utvideo_encode_init(AVCodecContext *avctx)
     }
 
     for (i = 0; i < c->planes; i++) {
-        c->slice_buffer[i] = av_malloc(c->slice_stride * (avctx->height + 2) +
+        c->slice_buffer[i] = av_malloc(c->slice_stride * (size_t)(avctx->height + 2) +
                                        AV_INPUT_BUFFER_PADDING_SIZE);
         if (!c->slice_buffer[i]) {
             av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer 1.\n");
diff --git a/libavcodec/v4l2_context.c b/libavcodec/v4l2_context.c
index be1df3785b..7b0387ab65 100644
--- a/libavcodec/v4l2_context.c
+++ b/libavcodec/v4l2_context.c
@@ -736,7 +736,7 @@ int ff_v4l2_context_init(V4L2Context* ctx)
     }
 
     ctx->num_buffers = req.count;
-    ctx->buffers = av_mallocz(ctx->num_buffers * sizeof(V4L2Buffer));
+    ctx->buffers = av_calloc(ctx->num_buffers, sizeof(V4L2Buffer));
     if (!ctx->buffers) {
         av_log(logger(ctx), AV_LOG_ERROR, "%s malloc enomem\n", ctx->name);
         return AVERROR(ENOMEM);
diff --git a/libavcodec/vb.c b/libavcodec/vb.c
index bd5f786bd1..3fc7eb5252 100644
--- a/libavcodec/vb.c
+++ b/libavcodec/vb.c
@@ -258,8 +258,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
     c->avctx       = avctx;
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
-    c->frame      = av_mallocz(avctx->width * avctx->height);
-    c->prev_frame = av_mallocz(avctx->width * avctx->height);
+    c->frame      = av_calloc(avctx->width, avctx->height);
+    c->prev_frame = av_calloc(avctx->width, avctx->height);
 
     if (!c->frame || !c->prev_frame)
         return AVERROR(ENOMEM);
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 1102e8123e..8a14a6bc2c 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -363,52 +363,52 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v)
     int mb_height = FFALIGN(s->mb_height, 2);
 
     /* Allocate mb bitplanes */
-    v->mv_type_mb_plane = av_malloc (s->mb_stride * mb_height);
-    v->direct_mb_plane  = av_malloc (s->mb_stride * mb_height);
-    v->forward_mb_plane = av_malloc (s->mb_stride * mb_height);
-    v->fieldtx_plane    = av_mallocz(s->mb_stride * mb_height);
-    v->acpred_plane     = av_malloc (s->mb_stride * mb_height);
-    v->over_flags_plane = av_malloc (s->mb_stride * mb_height);
+    v->mv_type_mb_plane = av_malloc_array (s->mb_stride, mb_height);
+    v->direct_mb_plane  = av_malloc_array (s->mb_stride, mb_height);
+    v->forward_mb_plane = av_malloc_array (s->mb_stride, mb_height);
+    v->fieldtx_plane    = av_calloc(s->mb_stride, mb_height);
+    v->acpred_plane     = av_malloc_array (s->mb_stride, mb_height);
+    v->over_flags_plane = av_malloc_array (s->mb_stride, mb_height);
     if (!v->mv_type_mb_plane || !v->direct_mb_plane || !v->forward_mb_plane ||
         !v->fieldtx_plane || !v->acpred_plane || !v->over_flags_plane)
         return AVERROR(ENOMEM);
 
     v->n_allocated_blks = s->mb_width + 2;
-    v->block            = av_malloc(sizeof(*v->block) * v->n_allocated_blks);
-    v->cbp_base         = av_malloc(sizeof(v->cbp_base[0]) * 3 * s->mb_stride);
+    v->block            = av_malloc_array(v->n_allocated_blks, sizeof(*v->block));
+    v->cbp_base         = av_malloc_array(3 * s->mb_stride, sizeof(v->cbp_base[0]));
     if (!v->block || !v->cbp_base)
         return AVERROR(ENOMEM);
     v->cbp              = v->cbp_base + 2 * s->mb_stride;
-    v->ttblk_base       = av_mallocz(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride);
+    v->ttblk_base       = av_calloc(3 * s->mb_stride, sizeof(v->ttblk_base[0]));
     if (!v->ttblk_base)
         return AVERROR(ENOMEM);
     v->ttblk            = v->ttblk_base + 2 * s->mb_stride;
-    v->is_intra_base    = av_mallocz(sizeof(v->is_intra_base[0]) * 3 * s->mb_stride);
+    v->is_intra_base    = av_calloc(3 * s->mb_stride, sizeof(v->is_intra_base[0]));
     if (!v->is_intra_base)
         return AVERROR(ENOMEM);
     v->is_intra         = v->is_intra_base + 2 * s->mb_stride;
-    v->luma_mv_base     = av_mallocz(sizeof(v->luma_mv_base[0]) * 3 * s->mb_stride);
+    v->luma_mv_base     = av_calloc(3 * s->mb_stride, sizeof(v->luma_mv_base[0]));
     if (!v->luma_mv_base)
         return AVERROR(ENOMEM);
     v->luma_mv          = v->luma_mv_base + 2 * s->mb_stride;
 
     /* allocate block type info in that way so it could be used with s->block_index[] */
-    v->mb_type_base = av_mallocz(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2);
+    v->mb_type_base = av_mallocz(s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2);
     if (!v->mb_type_base)
         return AVERROR(ENOMEM);
     v->mb_type = v->mb_type_base + s->b8_stride + 1;
 
     /* allocate memory to store block level MV info */
-    v->blk_mv_type_base = av_mallocz(     s->b8_stride * (mb_height * 2 + 1));
+    v->blk_mv_type_base = av_calloc(s->b8_stride, mb_height * 2 + 1);
     if (!v->blk_mv_type_base)
         return AVERROR(ENOMEM);
     v->blk_mv_type      = v->blk_mv_type_base + s->b8_stride + 1;
-    v->mv_f_base        = av_mallocz(2 * (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2));
+    v->mv_f_base        = av_mallocz(2 * (s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2));
     if (!v->mv_f_base)
         return AVERROR(ENOMEM);
     v->mv_f[0]          = v->mv_f_base + s->b8_stride + 1;
     v->mv_f[1]          = v->mv_f[0] + (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2);
-    v->mv_f_next_base   = av_mallocz(2 * (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2));
+    v->mv_f_next_base   = av_mallocz(2 * (s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2));
     if (!v->mv_f_next_base)
         return AVERROR(ENOMEM);
     v->mv_f_next[0]     = v->mv_f_next_base + s->b8_stride + 1;
diff --git a/libavcodec/vc2enc.c b/libavcodec/vc2enc.c
index 2c155c01a1..f761d173cc 100644
--- a/libavcodec/vc2enc.c
+++ b/libavcodec/vc2enc.c
@@ -1144,7 +1144,7 @@ static av_cold int vc2_encode_init(AVCodecContext *avctx)
         p->dwt_width  = w = FFALIGN(p->width,  (1 << s->wavelet_depth));
         p->dwt_height = h = FFALIGN(p->height, (1 << s->wavelet_depth));
         p->coef_stride = FFALIGN(p->dwt_width, 32);
-        p->coef_buf = av_mallocz(p->coef_stride*p->dwt_height*sizeof(dwtcoef));
+        p->coef_buf = av_calloc(p->coef_stride * (size_t)p->dwt_height, sizeof(dwtcoef));
         if (!p->coef_buf)
             return AVERROR(ENOMEM);
         for (level = s->wavelet_depth-1; level >= 0; level--) {
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index aeea1b4908..d8998e077c 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -254,10 +254,10 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc)
 
     ff_dlog(NULL, " Codebooks: %d \n", vc->codebook_count);
 
-    vc->codebooks = av_mallocz(vc->codebook_count * sizeof(*vc->codebooks));
-    tmp_vlc_bits  = av_mallocz(V_MAX_VLCS * sizeof(*tmp_vlc_bits));
-    tmp_vlc_codes = av_mallocz(V_MAX_VLCS * sizeof(*tmp_vlc_codes));
-    codebook_multiplicands = av_malloc(V_MAX_VLCS * sizeof(*codebook_multiplicands));
+    vc->codebooks = av_calloc(vc->codebook_count, sizeof(*vc->codebooks));
+    tmp_vlc_bits  = av_calloc(V_MAX_VLCS, sizeof(*tmp_vlc_bits));
+    tmp_vlc_codes = av_calloc(V_MAX_VLCS, sizeof(*tmp_vlc_codes));
+    codebook_multiplicands = av_malloc_array(V_MAX_VLCS, sizeof(*codebook_multiplicands));
     if (!vc->codebooks ||
         !tmp_vlc_bits || !tmp_vlc_codes || !codebook_multiplicands) {
         ret = AVERROR(ENOMEM);
@@ -513,7 +513,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
 
     vc->floor_count = get_bits(gb, 6) + 1;
 
-    vc->floors = av_mallocz(vc->floor_count * sizeof(*vc->floors));
+    vc->floors = av_calloc(vc->floor_count, sizeof(*vc->floors));
     if (!vc->floors)
         return AVERROR(ENOMEM);
 
@@ -702,7 +702,7 @@ static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
     unsigned i, j, k;
 
     vc->residue_count = get_bits(gb, 6)+1;
-    vc->residues      = av_mallocz(vc->residue_count * sizeof(*vc->residues));
+    vc->residues      = av_calloc(vc->residue_count, sizeof(*vc->residues));
     if (!vc->residues)
         return AVERROR(ENOMEM);
 
@@ -783,7 +783,7 @@ static int vorbis_parse_setup_hdr_mappings(vorbis_context *vc)
     unsigned i, j;
 
     vc->mapping_count = get_bits(gb, 6)+1;
-    vc->mappings      = av_mallocz(vc->mapping_count * sizeof(*vc->mappings));
+    vc->mappings      = av_calloc(vc->mapping_count, sizeof(*vc->mappings));
     if (!vc->mappings)
         return AVERROR(ENOMEM);
 
@@ -809,9 +809,9 @@ static int vorbis_parse_setup_hdr_mappings(vorbis_context *vc)
                        "Square polar channel mapping with less than two channels is not compliant with the Vorbis I specification.\n");
                 return AVERROR_INVALIDDATA;
             }
-            mapping_setup->magnitude      = av_mallocz(mapping_setup->coupling_steps *
+            mapping_setup->magnitude      = av_calloc(mapping_setup->coupling_steps,
                                                        sizeof(*mapping_setup->magnitude));
-            mapping_setup->angle          = av_mallocz(mapping_setup->coupling_steps *
+            mapping_setup->angle          = av_calloc(mapping_setup->coupling_steps,
                                                        sizeof(*mapping_setup->angle));
             if (!mapping_setup->angle || !mapping_setup->magnitude)
                 return AVERROR(ENOMEM);
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index 39cc00fefe..b21eeff7c5 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -227,15 +227,15 @@ int update_dimensions(VP8Context *s, int width, int height, int is_vp7)
     s->mb_layout = is_vp7 || avctx->active_thread_type == FF_THREAD_SLICE &&
                    avctx->thread_count > 1;
     if (!s->mb_layout) { // Frame threading and one thread
-        s->macroblocks_base       = av_mallocz((s->mb_width + s->mb_height * 2 + 1) *
+        s->macroblocks_base       = av_calloc(s->mb_width + (size_t)s->mb_height * 2 + 1,
                                                sizeof(*s->macroblocks));
-        s->intra4x4_pred_mode_top = av_mallocz(s->mb_width * 4);
+        s->intra4x4_pred_mode_top = av_calloc(s->mb_width, 4);
     } else // Sliced threading
-        s->macroblocks_base = av_mallocz((s->mb_width + 2) * (s->mb_height + 2) *
+        s->macroblocks_base = av_calloc((s->mb_width + 2) * (size_t)(s->mb_height + 2),
                                          sizeof(*s->macroblocks));
-    s->top_nnz     = av_mallocz(s->mb_width * sizeof(*s->top_nnz));
-    s->top_border  = av_mallocz((s->mb_width + 1) * sizeof(*s->top_border));
-    s->thread_data = av_mallocz(MAX_THREADS * sizeof(VP8ThreadData));
+    s->top_nnz     = av_calloc(s->mb_width, sizeof(*s->top_nnz));
+    s->top_border  = av_calloc(s->mb_width + 1, sizeof(*s->top_border));
+    s->thread_data = av_calloc(MAX_THREADS, sizeof(VP8ThreadData));
 
     if (!s->macroblocks_base || !s->top_nnz || !s->top_border ||
         !s->thread_data || (!s->intra4x4_pred_mode_top && !s->mb_layout)) {
@@ -245,7 +245,7 @@ int update_dimensions(VP8Context *s, int width, int height, int is_vp7)
 
     for (i = 0; i < MAX_THREADS; i++) {
         s->thread_data[i].filter_strength =
-            av_mallocz(s->mb_width * sizeof(*s->thread_data[0].filter_strength));
+            av_calloc(s->mb_width, sizeof(*s->thread_data[0].filter_strength));
         if (!s->thread_data[i].filter_strength) {
             free_buffers(s);
             return AVERROR(ENOMEM);
diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c
index bb69844327..6f9c5c2867 100644
--- a/libavcodec/vqcdec.c
+++ b/libavcodec/vqcdec.c
@@ -76,7 +76,7 @@ static av_cold int vqc_decode_init(AVCodecContext * avctx)
     if (avctx->width & 15)
         return AVERROR_PATCHWELCOME;
 
-    s->vectors = av_malloc((avctx->width * avctx->height * 3) / 2);
+    s->vectors = av_malloc_array(avctx->width, avctx->height * 3 / 2);
     if (!s->vectors)
         return AVERROR(ENOMEM);
 
diff --git a/libavcodec/xsubdec.c b/libavcodec/xsubdec.c
index 6be4c18b0b..61d9f27547 100644
--- a/libavcodec/xsubdec.c
+++ b/libavcodec/xsubdec.c
@@ -117,7 +117,7 @@ static int decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
     rect->w = w; rect->h = h;
     rect->type = SUBTITLE_BITMAP;
     rect->linesize[0] = w;
-    rect->data[0] = av_malloc(w * h);
+    rect->data[0] = av_malloc_array(w, h);
     rect->nb_colors = 4;
     rect->data[1] = av_mallocz(AVPALETTE_SIZE);
     if (!rect->data[0] || !rect->data[1])
diff --git a/libavformat/dashenc.c b/libavformat/dashenc.c
index 406ee2cf0d..1a43726b82 100644
--- a/libavformat/dashenc.c
+++ b/libavformat/dashenc.c
@@ -1354,7 +1354,7 @@ static int dash_init(AVFormatContext *s)
     if (ptr)
         *ptr = '\0';
 
-    c->streams = av_mallocz(sizeof(*c->streams) * s->nb_streams);
+    c->streams = av_calloc(s->nb_streams, sizeof(*c->streams));
     if (!c->streams)
         return AVERROR(ENOMEM);
 
diff --git a/libavformat/demux.c b/libavformat/demux.c
index 193fd17739..68d593edb3 100644
--- a/libavformat/demux.c
+++ b/libavformat/demux.c
@@ -2345,7 +2345,7 @@ int ff_rfps_add_frame(AVFormatContext *ic, AVStream *st, int64_t ts)
         int64_t duration = ts - last;
 
         if (!info->duration_error)
-            info->duration_error = av_mallocz(sizeof(info->duration_error[0])*2);
+            info->duration_error = av_calloc(2, sizeof(info->duration_error[0]));
         if (!info->duration_error)
             return AVERROR(ENOMEM);
 
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index 03310503d1..5c60fc24f5 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -568,7 +568,7 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, int64_t m
             // metadata for indexing
             break;
 
-        if (!(*current_array = av_mallocz(sizeof(**current_array) * arraylen))) {
+        if (!(*current_array = av_calloc(arraylen, sizeof(**current_array)))) {
             ret = AVERROR(ENOMEM);
             goto finish;
         }
diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c
index 0b69ae4b3b..250be87e39 100644
--- a/libavformat/hlsenc.c
+++ b/libavformat/hlsenc.c
@@ -2030,7 +2030,7 @@ static int parse_variant_stream_mapstring(AVFormatContext *s)
     }
     av_freep(&p);
 
-    hls->var_streams = av_mallocz(sizeof(*hls->var_streams) * nb_varstreams);
+    hls->var_streams = av_calloc(nb_varstreams, sizeof(*hls->var_streams));
     if (!hls->var_streams)
         return AVERROR(ENOMEM);
     hls->nb_varstreams = nb_varstreams;
@@ -2058,7 +2058,7 @@ static int parse_variant_stream_mapstring(AVFormatContext *s)
                 break;
             q++;
         }
-        vs->streams = av_mallocz(sizeof(AVStream *) * vs->nb_streams);
+        vs->streams = av_calloc(vs->nb_streams, sizeof(AVStream *));
         if (!vs->streams)
             return AVERROR(ENOMEM);
 
@@ -2160,7 +2160,7 @@ static int parse_cc_stream_mapstring(AVFormatContext *s)
     }
     av_freep(&p);
 
-    hls->cc_streams = av_mallocz(sizeof(*hls->cc_streams) * nb_ccstreams);
+    hls->cc_streams = av_calloc(nb_ccstreams, sizeof(*hls->cc_streams));
     if (!hls->cc_streams)
         return AVERROR(ENOMEM);
     hls->nb_ccstreams = nb_ccstreams;
@@ -2240,8 +2240,8 @@ static int update_variant_stream_info(AVFormatContext *s)
 
         hls->var_streams[0].var_stream_idx = 0;
         hls->var_streams[0].nb_streams = s->nb_streams;
-        hls->var_streams[0].streams = av_mallocz(sizeof(AVStream *) *
-                                            hls->var_streams[0].nb_streams);
+        hls->var_streams[0].streams = av_calloc(hls->var_streams[0].nb_streams,
+                                            sizeof(AVStream *));
         if (!hls->var_streams[0].streams)
             return AVERROR(ENOMEM);
 
diff --git a/libavformat/jvdec.c b/libavformat/jvdec.c
index 456a8c52e9..08aa8e12ad 100644
--- a/libavformat/jvdec.c
+++ b/libavformat/jvdec.c
@@ -110,12 +110,12 @@ static int read_header(AVFormatContext *s)
 
     avio_skip(pb, 10);
 
-    asti->index_entries = av_malloc(asti->nb_index_entries *
+    asti->index_entries = av_malloc_array(asti->nb_index_entries,
                                     sizeof(*asti->index_entries));
     if (!asti->index_entries)
         return AVERROR(ENOMEM);
 
-    jv->frames = av_malloc(asti->nb_index_entries * sizeof(*jv->frames));
+    jv->frames = av_malloc_array(asti->nb_index_entries, sizeof(*jv->frames));
     if (!jv->frames)
         return AVERROR(ENOMEM);
     offset = 0x68 + asti->nb_index_entries * 16;
diff --git a/libavformat/mov.c b/libavformat/mov.c
index bd5f456032..c09bf55235 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -675,7 +675,7 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     }
     av_free(sc->drefs);
     sc->drefs_count = 0;
-    sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));
+    sc->drefs = av_calloc(entries, sizeof(*sc->drefs));
     if (!sc->drefs)
         return AVERROR(ENOMEM);
     sc->drefs_count = entries;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]