ffmpeg roll of source to mar 9 version...

patched-ffmpeg-mt/libavcodec/tta.c

 /*
  * TTA (The Lossless True Audio) decoder
  * Copyright (c) 2006 Alex Beregszaszi
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
@@ skipping 314 matching lines @@
 
             if (unary == 0) {
                 depth = 0;
                 k = rice->k0;
             } else {
                 depth = 1;
                 k = rice->k1;
                 unary--;
             }
 
-            if (k)
+            if (get_bits_left(&s->gb) < k)
+                return -1;
+
+            if (k) {
+                if (k > MIN_CACHE_BITS)
+                    return -1;
                 value = (unary << k) + get_bits(&s->gb, k);
-            else
+            } else
                 value = unary;
 
             // FIXME: copy paste from original
             switch (depth) {
             case 1:
                 rice->sum1 += value - (rice->sum1 >> 4);
                 if (rice->k1 > 0 && rice->sum1 < shift_16[rice->k1])
                     rice->k1--;
                 else if(rice->sum1 > shift_16[rice->k1 + 1])
                     rice->k1++;
@@ skipping 49 matching lines @@
                 // decorrelate in case of stereo integer
                 if (!s->is_float && (s->channels > 1)) {
                     int32_t *r = p - 1;
                     for (*p += *r / 2; r > p - s->channels; r--)
                         *r = *(r + 1) - *r;
                 }
                 cur_chan = 0;
             }
         }
 
+        if (get_bits_left(&s->gb) < 32)
+            return -1;
         skip_bits(&s->gb, 32); // frame crc
 
         // convert to output buffer
         switch(s->bps) {
             case 2: {
                 uint16_t *samples = data;
                 for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) {
 //                    *samples++ = (unsigned char)*p;
 //                    *samples++ = (unsigned char)(*p >> 8);
                     *samples++ = *p;
@@ skipping 23 matching lines @@
     "tta",
     CODEC_TYPE_AUDIO,
     CODEC_ID_TTA,
     sizeof(TTAContext),
     tta_decode_init,
     NULL,
     tta_decode_close,
     tta_decode_frame,
     .long_name = NULL_IF_CONFIG_SMALL("True Audio (TTA)"),
 };