- for (i = 0; i < s->total_frames; i++)
- skip_bits(&s->gb, 32);
- skip_bits(&s->gb, 32); // CRC32 of seektable
+ if (avctx->extradata_size <= 26 || total_frames > INT_MAX / 4 ||
+ avctx->extradata_size - 26 < total_frames * 4)
+ av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
+ else if (avctx->err_recognition & AV_EF_CRCCHECK) {
+ int ret = tta_check_crc(s, avctx->extradata + 22, total_frames * 4);
+ if (ret < 0 && avctx->err_recognition & AV_EF_EXPLODE)
+ return AVERROR_INVALIDDATA;
+ }
+ skip_bits_long(&s->gb, 32 * total_frames);
+ skip_bits_long(&s->gb, 32); // CRC32 of seektable