av_malloc_array() and av_realloc_array(): nmemb and size arguments transposed

[francoisk]

At line 356 of libavutil/frame.c is the following call to av_malloc_array:

dst->extended_data = av_malloc_array(sizeof(*dst->extended_data), ch);

Looks like the arguments are the wrong way around. First is nmemb and second is the size of each member:

av_alloc_size(1, 2) void *av_malloc_array(size_t nmemb, size_t size);

Same goes for the call to av_realloc_array() at line 425 of the same file:

tmp = av_realloc_array(dst->extended_buf, sizeof(*dst->extended_buf),
                       src->nb_extended_buf);

This was flagged by gcc's -Wcalloc-transposed-args.

[francoisk]

Also in:

libavcodec/psymodel.c
libavcodec/ffv1dec.c
libavcodec/huffman.c

[mkver]

Fixed in 834bedf3121e9f9d551abb7994b87e630bf5fa5a and preceding commits.
Notice that I could not find any instance of this issue in ffv1dec.c.