diff options
author | Nedeljko Babic <nbabic@mips.com> | 2012-03-26 18:37:55 +0200 |
---|---|---|
committer | Nedeljko Babic <nbabic@mips.com> | 2012-04-03 15:38:02 +0200 |
commit | 72ee537239638fe480c569ee9e49877800c9dd37 (patch) | |
tree | 8294cfc95158e24392a5621adb4692869f09ea87 | |
parent | bcc4ee400392cf2abff3dd76ec435f420384c36e (diff) | |
download | tremor-72ee537239638fe480c569ee9e49877800c9dd37.tar.gz |
Port r16218 from libvorbis.
Fix for https://bugzilla.mozilla.org/show_bug.cgi?id=501279
[Import changes from Tremor (ba51e86 2010-10-14)]
-rw-r--r-- | res012.c | 12 |
1 files changed, 10 insertions, 2 deletions
@@ -52,11 +52,18 @@ int res_unpack(vorbis_info_residue *info, info->stagemasks=_ogg_malloc(info->partitions*sizeof(*info->stagemasks)); info->stagebooks=_ogg_malloc(info->partitions*8*sizeof(*info->stagebooks)); + /* check for premature EOP */ + if(info->groupbook<0)goto errout; for(j=0;j<info->partitions;j++){ int cascade=oggpack_read(opb,3); - if(oggpack_read(opb,1)) - cascade|=(oggpack_read(opb,5)<<3); + int cflag=oggpack_read(opb,1); + if(cflag<0) goto errout; + if(cflag){ + int c=oggpack_read(opb,5); + if(c<0) goto errout; + cascade|=(c<<3); + } info->stagemasks[j]=cascade; } @@ -65,6 +72,7 @@ int res_unpack(vorbis_info_residue *info, if((info->stagemasks[j]>>k)&1){ unsigned char book=(unsigned char)oggpack_read(opb,8); if(book>=ci->books)goto errout; + if(book<0) goto errout; info->stagebooks[j*8+k]=book; if(k+1>info->stages)info->stages=k+1; }else |