avformat: Use av_reallocp() where suitable

Signed-off-by: Diego Biurrun <diego@biurrun.de>

18 files changed, 92 insertions, 107 deletions

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 9aa6efe..ea7ecab 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -655,10 +655,11 @@ static int avi_read_header(AVFormatContext *s)
                     if (st->codec->codec_tag == 0 && st->codec->height > 0 &&
                         st->codec->extradata_size < 1U << 30) {
                         st->codec->extradata_size += 9;
-                        st->codec->extradata       = av_realloc(st->codec->extradata,
-                                                                st->codec->extradata_size +
-                                                                FF_INPUT_BUFFER_PADDING_SIZE);
-                        if (st->codec->extradata)
+                        if ((ret = av_reallocp(&st->codec->extradata,
+                                               st->codec->extradata_size +
+                                               FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
+                            return ret;
+                        else
                             memcpy(st->codec->extradata + st->codec->extradata_size - 9,
                                    "BottomUp", 9);
                     }
diff --git a/libavformat/avienc.c b/libavformat/avienc.c
index 751687e..e6d9dae 100644
--- a/libavformat/avienc.c
+++ b/libavformat/avienc.c
@@ -533,13 +533,13 @@ static int avi_write_packet(AVFormatContext *s, AVPacket *pkt)
     }
 
     if (s->pb->seekable) {
+        int err;
         AVIIndex* idx = &avist->indexes;
         int cl = idx->entry / AVI_INDEX_CLUSTER_SIZE;
         int id = idx->entry % AVI_INDEX_CLUSTER_SIZE;
         if (idx->ents_allocated <= idx->entry) {
-            idx->cluster = av_realloc(idx->cluster, (cl+1)*sizeof(void*));
-            if (!idx->cluster)
-                return -1;
+            if ((err = av_reallocp(&idx->cluster, (cl + 1) * sizeof(*idx->cluster))) < 0)
+                return err;
             idx->cluster[cl] = av_malloc(AVI_INDEX_CLUSTER_SIZE*sizeof(AVIIentry));
             if (!idx->cluster[cl])
                 return -1;
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 2354f47..7d76e0b 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -879,9 +879,9 @@ static int dyn_buf_write(void *opaque, uint8_t *buf, int buf_size)
     }
 
     if (new_allocated_size > d->allocated_size) {
-        d->buffer = av_realloc(d->buffer, new_allocated_size);
-        if(d->buffer == NULL)
-             return AVERROR(ENOMEM);
+        int err;
+        if ((err = av_reallocp(&d->buffer, new_allocated_size)) < 0)
+            return err;
         d->allocated_size = new_allocated_size;
     }
     memcpy(d->buffer + d->pos, buf, buf_size);
diff --git a/libavformat/bmv.c b/libavformat/bmv.c
index ce157e8..f474648 100644
--- a/libavformat/bmv.c
+++ b/libavformat/bmv.c
@@ -71,7 +71,7 @@ static int bmv_read_header(AVFormatContext *s)
 static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)
 {
     BMVContext *c = s->priv_data;
-    int type;
+    int type, err;
     void *tmp;
 
     while (c->get_next) {
@@ -85,10 +85,8 @@ static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)
         c->size = avio_rl24(s->pb);
         if (!c->size)
             return AVERROR_INVALIDDATA;
-        tmp = av_realloc(c->packet, c->size + 1);
-        if (!tmp)
-            return AVERROR(ENOMEM);
-        c->packet = tmp;
+        if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)
+            return err;
         c->packet[0] = type;
         if (avio_read(s->pb, c->packet + 1, c->size) != c->size)
             return AVERROR(EIO);
diff --git a/libavformat/concat.c b/libavformat/concat.c
index 24c50c1..4682d8a 100644
--- a/libavformat/concat.c
+++ b/libavformat/concat.c
@@ -56,7 +56,7 @@ static av_cold int concat_close(URLContext *h)
 
 static av_cold int concat_open(URLContext *h, const char *uri, int flags)
 {
-    char *node_uri = NULL, *tmp_uri;
+    char *node_uri = NULL;
     int err = 0;
     int64_t size;
     size_t  len, i;
@@ -85,11 +85,8 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags)
     for (i = 0; *uri; i++) {
         /* parsing uri */
         len = strcspn(uri, AV_CAT_SEPARATOR);
-        if (!(tmp_uri = av_realloc(node_uri, len+1))) {
-            err = AVERROR(ENOMEM);
+        if ((err = av_reallocp(&node_uri, len + 1)) < 0)
             break;
-        } else
-            node_uri = tmp_uri;
         av_strlcpy(node_uri, uri, len+1);
         uri += len + strspn(uri+len, AV_CAT_SEPARATOR);
 
@@ -114,10 +111,9 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags)
 
     if (err < 0)
         concat_close(h);
-    else if (!(nodes = av_realloc(nodes, data->length * sizeof(*nodes)))) {
+    else if ((err = av_reallocp(&nodes, data->length * sizeof(*nodes))) < 0)
         concat_close(h);
-        err = AVERROR(ENOMEM);
-    } else
+    else
         data->nodes = nodes;
     return err;
 }
diff --git a/libavformat/mmst.c b/libavformat/mmst.c
index 4b96f5d..41d01c4 100644
--- a/libavformat/mmst.c
+++ b/libavformat/mmst.c
@@ -331,16 +331,14 @@ static MMSSCPacketType get_tcp_server_response(MMSTContext *mmst)
 
             // if we successfully read everything.
             if(packet_id_type == mmst->header_packet_id) {
+                int err;
                 packet_type = SC_PKT_ASF_HEADER;
                 // Store the asf header
                 if(!mms->header_parsed) {
-                    void *p = av_realloc(mms->asf_header,
-                                  mms->asf_header_size + mms->remaining_in_len);
-                    if (!p) {
-                        av_freep(&mms->asf_header);
-                        return AVERROR(ENOMEM);
-                    }
-                    mms->asf_header = p;
+                    if ((err = av_reallocp(&mms->asf_header,
+                                           mms->asf_header_size +
+                                           mms->remaining_in_len)) < 0)
+                        return err;
                     memcpy(mms->asf_header + mms->asf_header_size,
                            mms->read_in_ptr, mms->remaining_in_len);
                     mms->asf_header_size += mms->remaining_in_len;
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 77ba444..a84fae8 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -878,6 +878,7 @@ static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     AVStream *st;
     uint64_t size;
     uint8_t *buf;
+    int err;
 
     if (c->fc->nb_streams < 1) // will happen with jp2 files
         return 0;
@@ -885,11 +886,9 @@ static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE;
     if (size > INT_MAX || (uint64_t)atom.size > INT_MAX)
         return AVERROR_INVALIDDATA;
-    buf= av_realloc(st->codec->extradata, size);
-    if (!buf)
-        return AVERROR(ENOMEM);
-    st->codec->extradata= buf;
-    buf+= st->codec->extradata_size;
+    if ((err = av_reallocp(&st->codec->extradata, size)) < 0)
+        return err;
+    buf = st->codec->extradata + st->codec->extradata_size;
     st->codec->extradata_size= size - FF_INPUT_BUFFER_PADDING_SIZE;
     AV_WB32(       buf    , atom.size + 8);
     AV_WL32(       buf + 4, atom.type);
diff --git a/libavformat/movenchint.c b/libavformat/movenchint.c
index 05a43cf..4570815 100644
--- a/libavformat/movenchint.c
+++ b/libavformat/movenchint.c
@@ -104,12 +104,9 @@ static void sample_queue_push(HintSampleQueue *queue, uint8_t *data, int size,
     if (size <= 14)
         return;
     if (!queue->samples || queue->len >= queue->size) {
-        HintSample *samples;
         queue->size += 10;
-        samples = av_realloc(queue->samples, sizeof(HintSample)*queue->size);
-        if (!samples)
+        if (av_reallocp(&queue->samples, sizeof(*queue->samples) * queue->size) < 0)
             return;
-        queue->samples = samples;
     }
     queue->samples[queue->len].data = data;
     queue->samples[queue->len].size = size;
diff --git a/libavformat/oggparsetheora.c b/libavformat/oggparsetheora.c
index ed31d53..94e9eba 100644
--- a/libavformat/oggparsetheora.c
+++ b/libavformat/oggparsetheora.c
@@ -42,7 +42,7 @@ theora_header (AVFormatContext * s, int idx)
     struct ogg_stream *os = ogg->streams + idx;
     AVStream *st = s->streams[idx];
     struct theora_params *thp = os->private;
-    int cds = st->codec->extradata_size + os->psize + 2;
+    int cds = st->codec->extradata_size + os->psize + 2, err;
     uint8_t *cdp;
 
     if(!(os->buf[os->pstart] & 0x80))
@@ -123,8 +123,9 @@ theora_header (AVFormatContext * s, int idx)
         return -1;
     }
 
-    st->codec->extradata = av_realloc (st->codec->extradata,
-                                       cds + FF_INPUT_BUFFER_PADDING_SIZE);
+    if ((err = av_reallocp(&st->codec->extradata,
+                           cds + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
+        return err;
     cdp = st->codec->extradata + st->codec->extradata_size;
     *cdp++ = os->psize >> 8;
     *cdp++ = os->psize & 0xff;
diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
index adf8f03..1a9776ef 100644
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -173,7 +173,7 @@ static unsigned int
 fixup_vorbis_headers(AVFormatContext * as, struct oggvorbis_private *priv,
                      uint8_t **buf)
 {
-    int i,offset, len;
+    int i, offset, len, err;
     unsigned char *ptr;
 
     len = priv->len[0] + priv->len[1] + priv->len[2];
@@ -188,7 +188,8 @@ fixup_vorbis_headers(AVFormatContext * as, struct oggvorbis_private *priv,
         offset += priv->len[i];
         av_freep(&priv->packet[i]);
     }
-    *buf = av_realloc(*buf, offset + FF_INPUT_BUFFER_PADDING_SIZE);
+    if ((err = av_reallocp(buf, offset + FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
+        return err;
     return offset;
 }
 
diff --git a/libavformat/rdt.c b/libavformat/rdt.c
index a8367e5..d691ae9 100644
--- a/libavformat/rdt.c
+++ b/libavformat/rdt.c
@@ -419,15 +419,14 @@ rdt_parse_sdp_line (AVFormatContext *s, int st_index,
 
         for (n = 0; n < s->nb_streams; n++)
             if (s->streams[n]->id == stream->id) {
-                int count = s->streams[n]->index + 1;
+                int count = s->streams[n]->index + 1, err;
                 if (first == -1) first = n;
                 if (rdt->nb_rmst < count) {
-                    RMStream **rmst= av_realloc(rdt->rmst, count*sizeof(*rmst));
-                    if (!rmst)
-                        return AVERROR(ENOMEM);
-                    memset(rmst + rdt->nb_rmst, 0,
-                           (count - rdt->nb_rmst) * sizeof(*rmst));
-                    rdt->rmst    = rmst;
+                    if ((err = av_reallocp(&rdt->rmst,
+                                           count * sizeof(*rdt->rmst))) < 0)
+                        return err;
+                    memset(rdt->rmst + rdt->nb_rmst, 0,
+                           (count - rdt->nb_rmst) * sizeof(*rdt->rmst));
                     rdt->nb_rmst = count;
                 }
                 rdt->rmst[s->streams[n]->index] = ff_rm_alloc_rmstream();
diff --git a/libavformat/rtmphttp.c b/libavformat/rtmphttp.c
index e67abba..5de1857 100644
--- a/libavformat/rtmphttp.c
+++ b/libavformat/rtmphttp.c
@@ -85,14 +85,12 @@ static int rtmp_http_send_cmd(URLContext *h, const char *cmd)
 static int rtmp_http_write(URLContext *h, const uint8_t *buf, int size)
 {
     RTMP_HTTPContext *rt = h->priv_data;
-    void *ptr;
 
     if (rt->out_size + size > rt->out_capacity) {
+        int err;
         rt->out_capacity = (rt->out_size + size) * 2;
-        ptr = av_realloc(rt->out_data, rt->out_capacity);
-        if (!ptr)
-            return AVERROR(ENOMEM);
-        rt->out_data = ptr;
+        if ((err = av_reallocp(&rt->out_data, rt->out_capacity)) < 0)
+            return err;
     }
 
     memcpy(rt->out_data + rt->out_size, buf, size);
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 9bdee5d..4cf0f0c 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -150,15 +150,13 @@ static const uint8_t rtmp_server_key[] = {
 
 static int add_tracked_method(RTMPContext *rt, const char *name, int id)
 {
-    void *ptr;
+    int err;
 
     if (rt->nb_tracked_methods + 1 > rt->tracked_methods_size) {
         rt->tracked_methods_size = (rt->nb_tracked_methods + 1) * 2;
-        ptr = av_realloc(rt->tracked_methods,
-                         rt->tracked_methods_size * sizeof(*rt->tracked_methods));
-        if (!ptr)
-            return AVERROR(ENOMEM);
-        rt->tracked_methods = ptr;
+        if ((err = av_reallocp(&rt->tracked_methods, rt->tracked_methods_size *
+                               sizeof(*rt->tracked_methods))) < 0)
+            return err;
     }
 
     rt->tracked_methods[rt->nb_tracked_methods].name = av_strdup(name);
@@ -2066,7 +2064,6 @@ static int handle_invoke(URLContext *s, RTMPPacket *pkt)
 static int handle_notify(URLContext *s, RTMPPacket *pkt) {
     RTMPContext *rt  = s->priv_data;
     const uint8_t *p = NULL;
-    uint8_t *cp      = NULL;
     uint8_t commandbuffer[64];
     char statusmsg[128];
     int stringlen;
@@ -2101,25 +2098,22 @@ static int handle_notify(URLContext *s, RTMPPacket *pkt) {
         old_flv_size  = rt->flv_size;
         rt->flv_size += datatowritelength + 15;
     } else {
+        int err;
         old_flv_size = 0;
         rt->flv_size = datatowritelength + 15;
         rt->flv_off  = 0;
+        if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)
+            return err;
+        bytestream2_init_writer(&pbc, rt->flv_data, rt->flv_size);
+        bytestream2_skip_p(&pbc, old_flv_size);
+        bytestream2_put_byte(&pbc, pkt->type);
+        bytestream2_put_be24(&pbc, datatowritelength);
+        bytestream2_put_be24(&pbc, ts);
+        bytestream2_put_byte(&pbc, ts >> 24);
+        bytestream2_put_be24(&pbc, 0);
+        bytestream2_put_buffer(&pbc, datatowrite, datatowritelength);
+        bytestream2_put_be32(&pbc, 0);
     }
-
-    cp = av_realloc(rt->flv_data, rt->flv_size);
-    if (!cp)
-        return AVERROR(ENOMEM);
-    rt->flv_data = cp;
-    bytestream2_init_writer(&pbc, cp, rt->flv_size);
-    bytestream2_skip_p(&pbc, old_flv_size);
-    bytestream2_put_byte(&pbc, pkt->type);
-    bytestream2_put_be24(&pbc, datatowritelength);
-    bytestream2_put_be24(&pbc, ts);
-    bytestream2_put_byte(&pbc, ts >> 24);
-    bytestream2_put_be24(&pbc, 0);
-    bytestream2_put_buffer(&pbc, datatowrite, datatowritelength);
-    bytestream2_put_be32(&pbc, 0);
-
     return 0;
 }
 
@@ -2189,7 +2183,6 @@ static int get_packet(URLContext *s, int for_header)
 {
     RTMPContext *rt = s->priv_data;
     int ret;
-    uint8_t *p;
     const uint8_t *next;
     uint32_t size;
     uint32_t ts, cts, pts=0;
@@ -2253,19 +2246,21 @@ static int get_packet(URLContext *s, int for_header)
         if (rpkt.type == RTMP_PT_VIDEO || rpkt.type == RTMP_PT_AUDIO ||
            (rpkt.type == RTMP_PT_NOTIFY &&
             ff_amf_match_string(rpkt.data, rpkt.size, "onMetaData"))) {
+            int err;
             ts = rpkt.timestamp;
 
             // generate packet header and put data into buffer for FLV demuxer
             rt->flv_off  = 0;
             rt->flv_size = rpkt.size + 15;
-            rt->flv_data = p = av_realloc(rt->flv_data, rt->flv_size);
-            bytestream_put_byte(&p, rpkt.type);
-            bytestream_put_be24(&p, rpkt.size);
-            bytestream_put_be24(&p, ts);
-            bytestream_put_byte(&p, ts >> 24);
-            bytestream_put_be24(&p, 0);
-            bytestream_put_buffer(&p, rpkt.data, rpkt.size);
-            bytestream_put_be32(&p, 0);
+            if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)
+                return err;
+            bytestream_put_byte(&rt->flv_data, rpkt.type);
+            bytestream_put_be24(&rt->flv_data, rpkt.size);
+            bytestream_put_be24(&rt->flv_data, ts);
+            bytestream_put_byte(&rt->flv_data, ts >> 24);
+            bytestream_put_be24(&rt->flv_data, 0);
+            bytestream_put_buffer(&rt->flv_data, rpkt.data, rpkt.size);
+            bytestream_put_be32(&rt->flv_data, 0);
             ff_rtmp_packet_destroy(&rpkt);
             return 0;
         } else if (rpkt.type == RTMP_PT_NOTIFY) {
@@ -2277,10 +2272,13 @@ static int get_packet(URLContext *s, int for_header)
             }
             return 0;
         } else if (rpkt.type == RTMP_PT_METADATA) {
+            int err;
+            uint8_t *p;
             // we got raw FLV data, make it available for FLV demuxer
             rt->flv_off  = 0;
             rt->flv_size = rpkt.size;
-            rt->flv_data = av_realloc(rt->flv_data, rt->flv_size);
+            if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)
+                return err;
             /* rewrite timestamps */
             next = rpkt.data;
             ts = rpkt.timestamp;
@@ -2549,9 +2547,11 @@ reconnect:
     }
 
     if (rt->is_input) {
+        int err;
         // generate FLV header for demuxer
         rt->flv_size = 13;
-        rt->flv_data = av_realloc(rt->flv_data, rt->flv_size);
+        if ((err = av_reallocp(&rt->flv_data, rt->flv_size)) < 0)
+            return err;
         rt->flv_off  = 0;
         memcpy(rt->flv_data, "FLV\1\5\0\0\0\011\0\0\0\0", rt->flv_size);
     } else {
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
index e425650..7c893af 100644
--- a/libavformat/rtpdec_asf.c
+++ b/libavformat/rtpdec_asf.c
@@ -239,14 +239,11 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
 
                 int cur_len = start_off + len_off - off;
                 int prev_len = out_len;
-                void *newmem;
                 out_len += cur_len;
                 if (FFMIN(cur_len, len - off) < 0)
                     return -1;
-                newmem = av_realloc(asf->buf, out_len);
-                if (!newmem)
-                    return -1;
-                asf->buf = newmem;
+                if ((res = av_reallocp(&asf->buf, out_len)) < 0)
+                    return res;
                 memcpy(asf->buf + prev_len, buf + off,
                        FFMIN(cur_len, len - off));
                 avio_skip(pb, cur_len);
diff --git a/libavformat/rtpdec_qt.c b/libavformat/rtpdec_qt.c
index af5a5e9..146002a 100644
--- a/libavformat/rtpdec_qt.c
+++ b/libavformat/rtpdec_qt.c
@@ -172,8 +172,10 @@ static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,
     switch (packing_scheme) {
     case 3: /* one data packet spread over 1 or multiple RTP packets */
         if (qt->pkt.size > 0 && qt->timestamp == *timestamp) {
-            qt->pkt.data = av_realloc(qt->pkt.data, qt->pkt.size + alen +
-                                      FF_INPUT_BUFFER_PADDING_SIZE);
+            int err;
+            if ((err = av_reallocp(&qt->pkt.data, qt->pkt.size + alen +
+                                   FF_INPUT_BUFFER_PADDING_SIZE)) < 0)
+                return err;
         } else {
             av_freep(&qt->pkt.data);
             av_init_packet(&qt->pkt);
@@ -181,8 +183,6 @@ static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,
             qt->pkt.size = 0;
             qt->timestamp = *timestamp;
         }
-        if (!qt->pkt.data)
-            return AVERROR(ENOMEM);
         memcpy(qt->pkt.data + qt->pkt.size, buf + avio_tell(&pb), alen);
         qt->pkt.size += alen;
         if (has_marker_bit) {
diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index f8a0769..e68c3fd 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -305,7 +305,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
         for(i = 0; i < 7; i++) {
             if(flags & 1) {
                 uint32_t size;
-                uint8_t *tmpbuf;
+                int err;
 
                 size = avio_rl32(s->pb) - 4;
                 if (!size || size > frame_size) {
@@ -315,10 +315,8 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
                 frame_size -= size;
                 frame_size -= 4;
                 smk->curstream++;
-                tmpbuf = av_realloc(smk->bufs[smk->curstream], size);
-                if (!tmpbuf)
-                    return AVERROR(ENOMEM);
-                smk->bufs[smk->curstream] = tmpbuf;
+                if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
+                    return err;
                 smk->buf_sizes[smk->curstream] = size;
                 ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
                 if(ret != size)
diff --git a/libavformat/smoothstreamingenc.c b/libavformat/smoothstreamingenc.c
index 7007264..9937f49 100644
--- a/libavformat/smoothstreamingenc.c
+++ b/libavformat/smoothstreamingenc.c
@@ -445,12 +445,13 @@ fail:
 
 static int add_fragment(OutputStream *os, const char *file, const char *infofile, int64_t start_time, int64_t duration, int64_t start_pos, int64_t size)
 {
+    int err;
     Fragment *frag;
     if (os->nb_fragments >= os->fragments_size) {
         os->fragments_size = (os->fragments_size + 1) * 2;
-        os->fragments = av_realloc(os->fragments, sizeof(*os->fragments)*os->fragments_size);
-        if (!os->fragments)
-            return AVERROR(ENOMEM);
+        if ((err = av_reallocp(&os->fragments, sizeof(*os->fragments) *
+                               os->fragments_size)) < 0)
+            return err;
     }
     frag = av_mallocz(sizeof(*frag));
     if (!frag)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 3d4366a..22f6d01 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -266,7 +266,8 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt,
         }
 
         /* read probe data */
-        buf = av_realloc(buf, probe_size + AVPROBE_PADDING_SIZE);
+        if ((ret = av_reallocp(&buf, probe_size + AVPROBE_PADDING_SIZE)) < 0)
+            return ret;
         if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) {
             /* fail if error was not end of file, otherwise, lower score */
             if (ret != AVERROR_EOF) {