1 files changed, 33 insertions, 0 deletions

diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index 28d0e9b..688c88d 100644
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -32,6 +32,7 @@
 #include <limits.h>
 #include "avcodec.h"
 #include "get_bits.h"
+#include "libavutil/crc.h"
 
 #define FORMAT_SIMPLE    1
 #define FORMAT_ENCRYPTED 2
@@ -58,6 +59,7 @@ typedef struct TTAContext {
     AVCodecContext *avctx;
     AVFrame frame;
     GetBitContext gb;
+    const AVCRC *crc_table;
 
     int format, channels, bps, data_length;
     int frame_length, last_frame_length, total_frames;
@@ -188,6 +190,20 @@ static int tta_get_unary(GetBitContext *gb)
     return ret;
 }
 
+static int tta_check_crc(TTAContext *s, const uint8_t *buf, int buf_size)
+{
+    uint32_t crc, CRC;
+
+    CRC = AV_RL32(buf + buf_size);
+    crc = av_crc(s->crc_table, 0xFFFFFFFFU, buf, buf_size);
+    if (CRC != (crc ^ 0xFFFFFFFFU)) {
+        av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    return 0;
+}
+
 static av_cold int tta_decode_init(AVCodecContext * avctx)
 {
     TTAContext *s = avctx->priv_data;
@@ -201,6 +217,12 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
     init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size * 8);
     if (show_bits_long(&s->gb, 32) == AV_RL32("TTA1"))
     {
+        if (avctx->err_recognition & AV_EF_CRCCHECK) {
+            s->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE);
+            if (tta_check_crc(s, avctx->extradata, 18))
+                return AVERROR_INVALIDDATA;
+        }
+
         /* signature */
         skip_bits_long(&s->gb, 32);
 
@@ -260,6 +282,12 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
             s->data_length, s->frame_length, s->last_frame_length, s->total_frames);
 
         // FIXME: seek table
+        if (get_bits_left(&s->gb) < 32 * s->total_frames + 32)
+            av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
+        else if (avctx->err_recognition & AV_EF_CRCCHECK) {
+            if (tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))
+                return AVERROR_INVALIDDATA;
+        }
         skip_bits_long(&s->gb, 32 * s->total_frames);
         skip_bits_long(&s->gb, 32); // CRC32 of seektable
 
@@ -299,6 +327,11 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data,
     int cur_chan = 0, framelen = s->frame_length;
     int32_t *p;
 
+    if (avctx->err_recognition & AV_EF_CRCCHECK) {
+        if (buf_size < 4 || tta_check_crc(s, buf, buf_size - 4))
+            return AVERROR_INVALIDDATA;
+    }
+
     init_get_bits(&s->gb, buf, buf_size*8);
 
     // FIXME: seeking