openharmony/third_party_ffmpeg
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_ffmpeg synced 2024-11-24 03:39:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ttadec: fix invalid free when an error occurs while decoding 24-bit tta

Browse Source
This commit is contained in:
Justin Ruggles 2012-02-09 14:49:59 -05:00
parent 9d7cee50aa
commit 6ab681a4c1
1 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libavcodec/tta.c
View File

@ -339,12 +339,16 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
unary--;
}
if (get_bits_left(&s->gb) < k)
return -1;
if (get_bits_left(&s->gb) < k) {
ret = AVERROR_INVALIDDATA;
goto error;
}
if (k) {
if (k > MIN_CACHE_BITS)
return -1;
if (k > MIN_CACHE_BITS) {
ret = AVERROR_INVALIDDATA;
goto error;
}
value = (unary << k) + get_bits(&s->gb, k);
} else
value = unary;
@ -397,8 +401,10 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
}
}
if (get_bits_left(&s->gb) < 32)
return -1;
if (get_bits_left(&s->gb) < 32) {
ret = AVERROR_INVALIDDATA;
goto error;
}
skip_bits_long(&s->gb, 32); // frame crc
// convert to output buffer
@ -419,6 +425,11 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
*(AVFrame *)data = s->frame;
return buf_size;
error:
// reset decode buffer
if (s->bps == 3)
s->decode_buffer = NULL;
return ret;
}
static av_cold int tta_decode_close(AVCodecContext *avctx) {