X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Ftta.c;h=1ab207961efdde8d04c0b7dd8bf12120df7c31e8;hb=1a625dce18cee97974ef19f16f9e14a6cb795502;hp=3b1dd844509fc9cc9aabd524d366a03e69718ea6;hpb=79a32e3b953c94268ed0691240dde053268f12cd;p=ffmpeg

diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index 3b1dd844509..1ab207961ef 100644
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -2,19 +2,21 @@
  * TTA (The Lossless True Audio) decoder
  * Copyright (c) 2006 Alex Beregszaszi
  *
- * This library is free software; you can redistribute it and/or
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
- * This library is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 /**
@@ -195,17 +197,6 @@ static int tta_get_unary(GetBitContext *gb)
     return ret;
 }
 
-// shamelessly copied from shorten.c
-static int inline get_le16(GetBitContext *gb)
-{
-    return bswap_16(get_bits_long(gb, 16));
-}
-
-static int inline get_le32(GetBitContext *gb)
-{
-    return bswap_32(get_bits_long(gb, 32));
-}
-
 static int tta_decode_init(AVCodecContext * avctx)
 {
     TTAContext *s = avctx->priv_data;
@@ -218,7 +209,7 @@ static int tta_decode_init(AVCodecContext * avctx)
         return -1;
 
     init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size);
-    if (show_bits_long(&s->gb, 32) == bswap_32(ff_get_fourcc("TTA1")))
+    if (show_bits_long(&s->gb, 32) == ff_get_fourcc("TTA1"))
     {
         /* signature */
         skip_bits(&s->gb, 32);
@@ -227,18 +218,22 @@ static int tta_decode_init(AVCodecContext * avctx)
 //            return -1;
 //        }
 
-        s->flags = get_le16(&s->gb);
+        s->flags = get_bits(&s->gb, 16);
         if (s->flags != 1 && s->flags != 3)
         {
             av_log(s->avctx, AV_LOG_ERROR, "Invalid flags\n");
             return -1;
         }
         s->is_float = (s->flags == FORMAT_FLOAT);
-        avctx->channels = s->channels = get_le16(&s->gb);
-        avctx->bits_per_sample = get_le16(&s->gb);
+        avctx->channels = s->channels = get_bits(&s->gb, 16);
+        avctx->bits_per_sample = get_bits(&s->gb, 16);
         s->bps = (avctx->bits_per_sample + 7) / 8;
-        avctx->sample_rate = get_le32(&s->gb);
-        s->data_length = get_le32(&s->gb);
+        avctx->sample_rate = get_bits_long(&s->gb, 32);
+        if(avctx->sample_rate > 1000000){ //prevent FRAME_TIME * avctx->sample_rate from overflowing and sanity check
+            av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
+            return -1;
+        }
+        s->data_length = get_bits_long(&s->gb, 32);
         skip_bits(&s->gb, 32); // CRC32 of header
 
         if (s->is_float)
@@ -276,6 +271,11 @@ static int tta_decode_init(AVCodecContext * avctx)
             skip_bits(&s->gb, 32);
         skip_bits(&s->gb, 32); // CRC32 of seektable
 
+        if(s->frame_length >= UINT_MAX / (s->channels * sizeof(int32_t))){
+            av_log(avctx, AV_LOG_ERROR, "frame_length too large\n");
+            return -1;
+        }
+
         s->decode_buffer = av_mallocz(sizeof(int32_t)*s->frame_length*s->channels);
     } else {
         av_log(avctx, AV_LOG_ERROR, "Wrong extradata present\n");
@@ -352,9 +352,9 @@ static int tta_decode_frame(AVCodecContext *avctx,
                     rice->k0++;
             }
 
-            // extract sign
-#define SIGN(x) (((x)&1) ? (++(x)>>1) : (-(x)>>1))
-            *p = SIGN(value);
+            // extract coded value
+#define UNFOLD(x) (((x)&1) ? (++(x)>>1) : (-(x)>>1))
+            *p = UNFOLD(value);
 
             // run hybrid filter
             ttafilter_process(filter, p, 0);