From 91aca46771ff48fb5a65e10253d4fc721ea74b8d Mon Sep 17 00:00:00 2001 From: Tim Terriberry Date: Fri, 29 Feb 2008 01:14:05 +0000 Subject: Fix possible read past the end of the buffer when reading 0 bits. git-svn-id: http://svn.xiph.org/trunk/ogg@14546 0101bb08-14d6-0310-b084-bc0e0c8e3800 --- src/bitwise.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src') diff --git a/src/bitwise.c b/src/bitwise.c index 83627e9..380119e 100644 --- a/src/bitwise.c +++ b/src/bitwise.c @@ -355,6 +355,9 @@ long oggpackB_read(oggpack_buffer *b,int bits){ /* not the main path */ ret=-1L; if(b->endbyte*8+bits>b->storage*8)goto overflow; + /* special case to avoid reading b->ptr[0], which might be past the end of + the buffer; also skips some useless accounting */ + else if(!bits)return(0L); } ret=b->ptr[0]<<(24+b->endbit); -- cgit v1.2.1