Port r16218 from libvorbis.

Fix for https://bugzilla.mozilla.org/show_bug.cgi?id=501279

[Import changes from Tremor (ba51e86 2010-10-14)]

1 files changed, 10 insertions, 2 deletions

diff --git a/res012.c b/res012.c
index fc64730..2694414 100644
--- a/res012.c
+++ b/res012.c
@@ -52,11 +52,18 @@ int res_unpack(vorbis_info_residue *info,
 
   info->stagemasks=_ogg_malloc(info->partitions*sizeof(*info->stagemasks));
   info->stagebooks=_ogg_malloc(info->partitions*8*sizeof(*info->stagebooks));
+  /* check for premature EOP */
+  if(info->groupbook<0)goto errout;
 
   for(j=0;j<info->partitions;j++){
     int cascade=oggpack_read(opb,3);
-    if(oggpack_read(opb,1))
-      cascade|=(oggpack_read(opb,5)<<3);
+    int cflag=oggpack_read(opb,1);
+    if(cflag<0) goto errout;
+    if(cflag){
+      int c=oggpack_read(opb,5);
+      if(c<0) goto errout;
+      cascade|=(c<<3);
+    }
     info->stagemasks[j]=cascade;
   }
 
@@ -65,6 +72,7 @@ int res_unpack(vorbis_info_residue *info,
       if((info->stagemasks[j]>>k)&1){
 	unsigned char book=(unsigned char)oggpack_read(opb,8);
 	if(book>=ci->books)goto errout;
+        if(book<0) goto errout;
 	info->stagebooks[j*8+k]=book;
 	if(k+1>info->stages)info->stages=k+1;
       }else