Commit 6ab681a4 authored by Justin Ruggles's avatar Justin Ruggles
Browse files

ttadec: fix invalid free when an error occurs while decoding 24-bit tta

parent 9d7cee50
......@@ -339,12 +339,16 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
unary--;
}
if (get_bits_left(&s->gb) < k)
return -1;
if (get_bits_left(&s->gb) < k) {
ret = AVERROR_INVALIDDATA;
goto error;
}
if (k) {
if (k > MIN_CACHE_BITS)
return -1;
if (k > MIN_CACHE_BITS) {
ret = AVERROR_INVALIDDATA;
goto error;
}
value = (unary << k) + get_bits(&s->gb, k);
} else
value = unary;
......@@ -397,8 +401,10 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
}
}
if (get_bits_left(&s->gb) < 32)
return -1;
if (get_bits_left(&s->gb) < 32) {
ret = AVERROR_INVALIDDATA;
goto error;
}
skip_bits_long(&s->gb, 32); // frame crc
// convert to output buffer
......@@ -419,6 +425,11 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
*(AVFrame *)data = s->frame;
return buf_size;
error:
// reset decode buffer
if (s->bps == 3)
s->decode_buffer = NULL;
return ret;
}
static av_cold int tta_decode_close(AVCodecContext *avctx) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment