decode: add a frame tile data buffer size check

This check was already done in dav1d_parse_obus(), so it's added as an assert
here for extra precaution.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/decode.c b/src/decode.c
index 63d6f8d..25deffc 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -3196,6 +3196,7 @@ int dav1d_submit_frame(Dav1dContext *const c) {
     // FIXME qsort so tiles are in order (for frame threading)
     if (f->n_tile_data_alloc < c->n_tile_data) {
         freep(&f->tile);
+        assert(c->n_tile_data < INT_MAX / (int)sizeof(*f->tile));
         f->tile = malloc(c->n_tile_data * sizeof(*f->tile));
         if (!f->tile) goto error;
         f->n_tile_data_alloc = c->n_tile_data;