Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavcodec / tta.c

diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index 0b6cefb4c1dd9223924ce0ea18025827b39f7933..84fa632960a59b3fb445a8ab9dfeb4bc77e800d5 100644 (file)
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -61,7 +61,8 @@ typedef struct TTAContext {
     GetBitContext gb;
     const AVCRC *crc_table;
 
-    int format, channels, bps, data_length;
+    int format, channels, bps;
+    unsigned data_length;
     int frame_length, last_frame_length, total_frames;
 
     int32_t *decode_buffer;
@@ -235,7 +236,7 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
         }
 
         // prevent overflow
-        if (avctx->sample_rate > 0x7FFFFF) {
+        if (avctx->sample_rate > 0x7FFFFFu) {
             av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
             return AVERROR(EINVAL);
         }
@@ -255,7 +256,8 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
             return AVERROR_INVALIDDATA;
 
         // FIXME: seek table
-        if (get_bits_left(&s->gb) < 32 * s->total_frames + 32)
+        if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
+            avctx->extradata_size - 26 < s->total_frames * 4)
             av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
         else if (avctx->err_recognition & AV_EF_CRCCHECK) {
             if (avctx->extradata_size < 26 + s->total_frames * 4 || tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))
@@ -400,7 +402,7 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
         if (cur_chan < (s->channels-1))
             cur_chan++;
         else {
-            // decorrelate in case of stereo integer
+            // decorrelate in case of multiple channels
             if (s->channels > 1) {
                 int32_t *r = p - 1;
                 for (*p += *r / 2; r > p - s->channels; r--)
@@ -472,5 +474,5 @@ AVCodec ff_tta_decoder = {
     .close          = tta_decode_close,
     .decode         = tta_decode_frame,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name = NULL_IF_CONFIG_SMALL("True Audio (TTA)"),
+    .long_name      = NULL_IF_CONFIG_SMALL("True Audio (TTA)"),
 };