X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=modules%2Fdemux%2Ftta.c;h=bc7ae25a7045449fa955b638e52cde5a5bf128ef;hb=6e41ca0135153181e3a922f0347154c4b83bac0e;hp=42fda085f9708d3cad36a4218b3826b07e7b6d66;hpb=3561b9b28f58eb7a4183e158a8fd973800d31ceb;p=vlc

diff --git a/modules/demux/tta.c b/modules/demux/tta.c
index 42fda085f9..bc7ae25a70 100644
--- a/modules/demux/tta.c
+++ b/modules/demux/tta.c
@@ -65,10 +65,10 @@ struct demux_sys_t
     es_out_id_t *p_es;
 
     /* */
-    int      i_totalframes;
-    int      i_currentframe;
+    uint32_t i_totalframes;
+    uint32_t i_currentframe;
     uint32_t *pi_seektable;
-    int      i_datalength;
+    uint32_t i_datalength;
     int      i_framelength;
 
     /* */
@@ -86,8 +86,8 @@ static int Open( vlc_object_t * p_this )
     es_format_t fmt;
     const uint8_t *p_peek;
     uint8_t     p_header[22];
-    uint8_t     *p_seektable;
-    int         i_seektable_size = 0, i;
+    uint8_t     *p_fullheader;
+    int         i_seektable_size = 0;
     //char        psz_info[4096];
     //module_t    *p_id3;
 
@@ -99,7 +99,7 @@ static int Open( vlc_object_t * p_this )
         if( !p_demux->b_force ) return VLC_EGENERIC;
 
         /* User forced */
-        msg_Err( p_demux, "this doesn't look like a flac stream, "
+        msg_Err( p_demux, "this doesn't look like a true-audio stream, "
                  "continuing anyway" );
     }
 
@@ -113,59 +113,63 @@ static int Open( vlc_object_t * p_this )
     if( !p_sys )
         return VLC_ENOMEM;
 
+    p_sys->pi_seektable = NULL;
+
     /* Read the metadata */
     es_format_Init( &fmt, AUDIO_ES, VLC_FOURCC( 'T', 'T', 'A', '1' ) );
     fmt.audio.i_channels = GetWLE( &p_header[6] );
     fmt.audio.i_bitspersample = GetWLE( &p_header[8] );
     fmt.audio.i_rate = GetDWLE( &p_header[10] );
+    if( fmt.audio.i_rate == 0 || /* Avoid divide by 0 */
+        fmt.audio.i_rate > ( 1 << 20 ) /* Avoid i_framelength overflow */ )
+    {
+        msg_Warn( p_demux, "Wrong sample rate" );
+        goto error;
+    }
 
     p_sys->i_datalength = GetDWLE( &p_header[14] );
     p_sys->i_framelength = TTA_FRAMETIME * fmt.audio.i_rate;
 
     p_sys->i_totalframes = p_sys->i_datalength / p_sys->i_framelength +
-                          ((p_sys->i_datalength % p_sys->i_framelength) ? 1 : 0);
+                          ((p_sys->i_datalength % p_sys->i_framelength) != 0);
     p_sys->i_currentframe = 0;
+    if( p_sys->i_totalframes > (1 << 29))
+        goto error;
 
     i_seektable_size = sizeof(uint32_t)*p_sys->i_totalframes;
-    p_seektable = (uint8_t *)malloc( i_seektable_size );
-    if( !p_seektable )
-    {
-        free( p_sys );
-        return VLC_ENOMEM;
-    }
 
-    stream_Read( p_demux->s, p_seektable, i_seektable_size );
-    p_sys->pi_seektable = (uint32_t *)malloc( i_seektable_size );
+    /* Store the header and Seektable for avcodec */
+    fmt.i_extra = 22 + i_seektable_size + 4;
+    fmt.p_extra = p_fullheader = malloc( fmt.i_extra );
+    if( !p_fullheader )
+        goto error;
+
+    memcpy( p_fullheader, p_header, 22 );
+    p_fullheader += 22;
+    if( stream_Read( p_demux->s, p_fullheader, i_seektable_size )
+             != i_seektable_size )
+        goto error;
+
+    p_sys->pi_seektable = calloc( p_sys->i_totalframes, sizeof(uint32_t) );
     if( !p_sys->pi_seektable )
+        goto error;
+    for( uint32_t i = 0; i < p_sys->i_totalframes; i++ )
     {
-        free( p_seektable );
-        free( p_sys );
-        return VLC_ENOMEM;
+        p_sys->pi_seektable[i] = GetDWLE( p_fullheader );
+        p_fullheader += 4;
     }
 
-    for( i = 0; i < p_sys->i_totalframes; i++ )
-        p_sys->pi_seektable[i] = GetDWLE( &p_seektable[i*4] );
-
-    stream_Read( p_demux->s, NULL, 4 ); /* CRC */
-
-    /* Store the header and Seektable for avcodec */
-    fmt.i_extra = 22 + (p_sys->i_totalframes * 4) + 4;
-    fmt.p_extra = malloc( fmt.i_extra );
-    if( !fmt.p_extra )
-    {
-        free( p_sys->pi_seektable );
-        free( p_seektable );
-        free( p_sys );
-        return VLC_ENOMEM;
-    }
-    memcpy( (uint8_t*)fmt.p_extra, p_header, 22 );
-    memcpy( (uint8_t*)fmt.p_extra+22, p_seektable, fmt.i_extra -22 );
+    stream_Read( p_demux->s, p_fullheader, 4 ); /* CRC */
+    p_fullheader += 4;
 
     p_sys->p_es = es_out_Add( p_demux->out, &fmt );
-    free( p_seektable );
-    p_sys->i_start = stream_Tell( p_demux->s );
+    p_sys->i_start = p_fullheader - (uint8_t *)fmt.p_extra;
 
     return VLC_SUCCESS;
+error:
+    es_format_Clean( &fmt );
+    Close( p_this );
+    return VLC_EGENERIC;
 }
 
 /*****************************************************************************
@@ -236,7 +240,7 @@ static int Control( demux_t *p_demux, int i_query, va_list args )
             if( i64 > 0 )
             {
                 int64_t tmp = 0;
-                int     i;
+                uint32_t i;
                 for( i=0; i < p_sys->i_totalframes && tmp+p_sys->pi_seektable[i] < i64; i++)
                 {
                     tmp += p_sys->pi_seektable[i];