aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/tta.c
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-03-29 12:44:55 -0700
committerRonald S. Bultje <rsbultje@gmail.com>2012-05-02 10:16:57 -0700
commitac80b812cd177553339467ea12548d71c9ef6865 (patch)
tree1c68089fa4c3f7e773a35d95f19dd4dc63990c43 /libavcodec/tta.c
parent77cfb2563c6bc234a354c1694de8a9eb76a309cf (diff)
downloadffmpeg-ac80b812cd177553339467ea12548d71c9ef6865.tar.gz
tta: prevents overflows for 32bit integers in header.
This prevents sample_rate/data_length from going negative, which caused various crashes and undefined behaviour further down. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/tta.c')
-rw-r--r--libavcodec/tta.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index acaeaaa948..e28023f941 100644
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -61,7 +61,8 @@ typedef struct TTAContext {
GetBitContext gb;
const AVCRC *crc_table;
- int format, channels, bps, data_length;
+ int format, channels, bps;
+ unsigned data_length;
int frame_length, last_frame_length, total_frames;
int32_t *decode_buffer;
@@ -253,7 +254,7 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
}
// prevent overflow
- if (avctx->sample_rate > 0x7FFFFF) {
+ if (avctx->sample_rate > 0x7FFFFFu) {
av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
return AVERROR(EINVAL);
}
@@ -270,7 +271,8 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
s->data_length, s->frame_length, s->last_frame_length, s->total_frames);
// FIXME: seek table
- if (get_bits_left(&s->gb) < 32 * s->total_frames + 32)
+ if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
+ avctx->extradata_size - 26 < s->total_frames * 4)
av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
else if (avctx->err_recognition & AV_EF_CRCCHECK) {
if (tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))