realloc size is too short. must be multiplied by sizeof type.

diff --git a/src/swf_tag_button.c b/src/swf_tag_button.c
index dd0ea9e..e32f2c8 100644 (file)
--- a/src/swf_tag_button.c
+++ b/src/swf_tag_button.c
@@ -140,7 +140,7 @@ swf_tag_button_character_get_refcid_list(swf_tag_t *tag, int *cid_list_num) {
             if (cid_list_alloc <= *cid_list_num) {
                 int *tmp;
                 cid_list_alloc *= 2;
-                tmp = realloc(cid_list, cid_list_alloc);
+                tmp = realloc(cid_list, sizeof(int) * cid_list_alloc);
                 if (tmp == NULL) {
                     fprintf(stderr, "swf_tag_shape_bitmap_get_refcid_list: Can't realloc memory (%p, %d)\n", cid_list, cid_list_alloc);
                     free(cid_list);

diff --git a/src/swf_tag_shape.c b/src/swf_tag_shape.c
index 471a085..a1165f2 100644 (file)
--- a/src/swf_tag_shape.c
+++ b/src/swf_tag_shape.c
@@ -227,7 +227,7 @@ swf_tag_shape_bitmap_get_refcid_list(swf_tag_t *tag, int *cid_list_num) {
                 if (fill_style->bitmap.bitmap_ref != 0xffff) {
                     if (cid_list_alloc <= *cid_list_num) {
                         cid_list_alloc *= 2;
-                        tmp = realloc(cid_list, cid_list_alloc);
+                        tmp = realloc(cid_list, sizeof(int) * cid_list_alloc);
                         if (tmp == NULL) {
                             fprintf(stderr, "swf_tag_shape_bitmap_get_refcid_list: Can't realloc memory (%p, %d)\n", cid_list, cid_list_alloc);
                             free(cid_list);