diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-09 14:49:59 -0500 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-10 20:35:10 -0500 |
| commit | 6ab681a4c1ffc0d5c36ebf13a10e0ecc61c81429 (patch) | |
| tree | 52f7eedeb5eddeef2c9a850ce96020ab8cd10d9b /libavcodec | |
| parent | 9d7cee50aa349563aa5faca1cff256ffccff6551 (diff) | |
| download | ffmpeg-6ab681a4c1ffc0d5c36ebf13a10e0ecc61c81429.tar.gz | |
ttadec: fix invalid free when an error occurs while decoding 24-bit tta
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/tta.c | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/libavcodec/tta.c b/libavcodec/tta.c index 49d59538d3..853f6a2aae 100644 --- a/libavcodec/tta.c +++ b/libavcodec/tta.c @@ -339,12 +339,16 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, unary--; } - if (get_bits_left(&s->gb) < k) - return -1; + if (get_bits_left(&s->gb) < k) { + ret = AVERROR_INVALIDDATA; + goto error; + } if (k) { - if (k > MIN_CACHE_BITS) - return -1; + if (k > MIN_CACHE_BITS) { + ret = AVERROR_INVALIDDATA; + goto error; + } value = (unary << k) + get_bits(&s->gb, k); } else value = unary; @@ -397,8 +401,10 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, } } - if (get_bits_left(&s->gb) < 32) - return -1; + if (get_bits_left(&s->gb) < 32) { + ret = AVERROR_INVALIDDATA; + goto error; + } skip_bits_long(&s->gb, 32); // frame crc // convert to output buffer @@ -419,6 +425,11 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, *(AVFrame *)data = s->frame; return buf_size; +error: + // reset decode buffer + if (s->bps == 3) + s->decode_buffer = NULL; + return ret; } static av_cold int tta_decode_close(AVCodecContext *avctx) { |