eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

tta: prevents overflows for 32bit integers in header.

Browse Source 
This prevents sample_rate/data_length from going negative, which
caused various crashes and undefined behaviour further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ac80b812cd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Ronald S. Bultje
2012-03-29 12:44:55 -07:00
committed by Reinhard Tartler
parent 994c0efcc7
commit 0e4bb0530f
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/tta.c
+5 -3
View File
@@ -61,7 +61,8 @@ typedef struct TTAContext {
GetBitContext gb;
const AVCRC *crc_table;
int format, channels, bps, data_length;
int format, channels, bps;
unsigned data_length;
int frame_length, last_frame_length, total_frames;
int32_t *decode_buffer;
@@ -265,7 +266,7 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
}
// prevent overflow
if (avctx->sample_rate > 0x7FFFFF) {
if (avctx->sample_rate > 0x7FFFFFu) {
av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
return AVERROR(EINVAL);
}
@@ -282,7 +283,8 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
s->data_length, s->frame_length, s->last_frame_length, s->total_frames);
// FIXME: seek table
if (get_bits_left(&s->gb) < 32 * s->total_frames + 32)
if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
avctx->extradata_size - 26 < s->total_frames * 4)
av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
else if (avctx->err_recognition & AV_EF_CRCCHECK) {
if (tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))