Crc crash

libavformat/aviobuf.c

@@ -308,7 +308,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
         ctx->seek_count++;
         if (!s->write_flag)
             s->buf_end = s->buffer;
-        s->buf_ptr = s->buf_ptr_max = s->buffer;
+        s->checksum_ptr = s->buf_ptr = s->buf_ptr_max = s->buffer;
         s->pos = offset;
     }
     s->eof_reached = 0;

libavformat/oggdec.c

@@ -370,7 +370,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing)
     flags   = avio_r8(bc);
     gp      = avio_rl64(bc);
     serial  = avio_rl32(bc);
-    avio_skip(bc, 4); /* seq */
+    avio_rl32(bc); /* seq */
 
     crc_tmp = ffio_get_checksum(bc);
     crc     = avio_rb32(bc);

libavformat/takdec.c

@@ -141,10 +141,11 @@ static int tak_read_header(AVFormatContext *s)
             tc->data_end += curpos;
             return 0;
         }
-        default:
-            ret = avio_skip(pb, size);
-            if (ret < 0)
-                return ret;
+        default: {
+            int64_t ret64 = avio_skip(pb, size);
+            if (ret64 < 0)
+                return ret64;
+        }
         }
 
         if (type == TAK_METADATA_STREAMINFO) {

libavformat/tta.c

@@ -51,36 +51,34 @@ static int tta_read_header(AVFormatContext *s)
 {
     TTAContext *c = s->priv_data;
     AVStream *st;
-    int i, channels, bps, samplerate;
-    int64_t framepos, start_offset;
-    uint32_t nb_samples, crc;
+    int64_t framepos;
+    uint8_t header[22];
 
     ff_id3v1_read(s);
 
-    start_offset = avio_tell(s->pb);
-    if (start_offset < 0)
-        return start_offset;
-    ffio_init_checksum(s->pb, ff_crcEDB88320_update, UINT32_MAX);
-    if (avio_rl32(s->pb) != AV_RL32("TTA1"))
+    int ret = ffio_read_size(s->pb, header, sizeof(header));
+    if (ret < 0)
+        return ret;
+
+    if (AV_RL32(header) != MKTAG('T', 'T', 'A', '1'))
         return AVERROR_INVALIDDATA;
 
-    avio_skip(s->pb, 2); // FIXME: flags
-    channels = avio_rl16(s->pb);
-    bps = avio_rl16(s->pb);
-    samplerate = avio_rl32(s->pb);
+    int channels   = AV_RL16(header +  6);
+    int bps        = AV_RL16(header +  8);
+    int samplerate = AV_RL32(header + 10);
     if(samplerate <= 0 || samplerate > 1000000){
         av_log(s, AV_LOG_ERROR, "nonsense samplerate\n");
         return AVERROR_INVALIDDATA;
     }
 
-    nb_samples = avio_rl32(s->pb);
+    uint32_t nb_samples = AV_RL32(header + 14);
     if (!nb_samples) {
         av_log(s, AV_LOG_ERROR, "invalid number of samples\n");
         return AVERROR_INVALIDDATA;
     }
 
-    crc = ffio_get_checksum(s->pb) ^ UINT32_MAX;
-    if (crc != avio_rl32(s->pb) && s->error_recognition & AV_EF_CRCCHECK) {
+    uint32_t crc = av_crc(av_crc_get_table(AV_CRC_32_IEEE_LE), UINT32_MAX, header, 18) ^ UINT32_MAX;
+    if (crc != AV_RL32(header + 18) && s->error_recognition & AV_EF_CRCCHECK) {
         av_log(s, AV_LOG_ERROR, "Header CRC error\n");
         return AVERROR_INVALIDDATA;
     }
@@ -105,19 +103,18 @@ static int tta_read_header(AVFormatContext *s)
     st->start_time = 0;
     st->duration = nb_samples;
 
+    ret = ff_alloc_extradata(st->codecpar, sizeof(header));
+    if (ret < 0)
+        return ret;
+    memcpy(st->codecpar->extradata, header, sizeof(header));
+
     framepos = avio_tell(s->pb);
     if (framepos < 0)
         return framepos;
     framepos += 4 * c->totalframes + 4;
 
-    if (ff_alloc_extradata(st->codecpar, avio_tell(s->pb) - start_offset))
-        return AVERROR(ENOMEM);
-
-    avio_seek(s->pb, start_offset, SEEK_SET);
-    avio_read(s->pb, st->codecpar->extradata, st->codecpar->extradata_size);
-
     ffio_init_checksum(s->pb, ff_crcEDB88320_update, UINT32_MAX);
-    for (i = 0; i < c->totalframes; i++) {
+    for (int i = 0; i < c->totalframes; i++) {
         uint32_t size = avio_rl32(s->pb);
         int r;
         if (avio_feof(s->pb))