Add additional check

Disallow books with dim<1 and book index < 0 in floor0

[Import changes from Tremor (8b4f038 2010-10-18)]

1 files changed, 36 insertions, 34 deletions

diff --git a/floor0.c b/floor0.c
index d1d5c78..7ce0b7e 100644
--- a/floor0.c
+++ b/floor0.c
@@ -33,12 +33,12 @@ extern const ogg_int32_t FLOOR_fromdB_LOOKUP[];
 #include "lsp_lookup.h"
 
 /* interpolated 1./sqrt(p) where .5 <= a < 1. (.100000... to .111111...) in
-   16.16 format 
+   16.16 format
    returns in m.8 format */
 
 static long ADJUST_SQRT2[2]={8192,5792};
 STIN ogg_int32_t vorbis_invsqlook_i(long a,long e){
-  long i=(a&0x7fff)>>(INVSQ_LOOKUP_I_SHIFT-1); 
+  long i=(a&0x7fff)>>(INVSQ_LOOKUP_I_SHIFT-1);
   long d=a&INVSQ_LOOKUP_I_MASK;                              /*  0.10 */
   long val=INVSQ_LOOKUP_I[i]-                                /*  1.16 */
     ((INVSQ_LOOKUP_IDel[i]*d)>>INVSQ_LOOKUP_I_SHIFT);        /* result 1.16 */
@@ -95,13 +95,13 @@ static const ogg_uint16_t barklook[54]={
 /* used in init only; interpolate the long way */
 STIN ogg_int32_t toBARK(int n){
   int i;
-  for(i=0;i<54;i++) 
+  for(i=0;i<54;i++)
     if(n>=barklook[i] && n<barklook[i+1])break;
-  
+
   if(i==54){
     return 54<<14;
   }else{
-    return (i<<14)+(((n-barklook[i])*  
+    return (i<<14)+(((n-barklook[i])*
 		     ((1UL<<31)/(barklook[i+1]-barklook[i])))>>17);
   }
 }
@@ -189,22 +189,22 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
 
     pi=((pi*pi)>>16);
     qi=((qi*qi)>>16);
-    
+
     if(m&1){
-      qexp= qexp*2-28*((m+1)>>1)+m;	     
+      qexp= qexp*2-28*((m+1)>>1)+m;
       pi*=(1<<14)-((wi*wi)>>14);
-      qi+=pi>>14;     
+      qi+=pi>>14;
     }else{
       qexp= qexp*2-13*m;
-      
+
       pi*=(1<<14)-wi;
       qi*=(1<<14)+wi;
-      
+
       qi=(qi+pi)>>14;
     }
-    
+
     if(qi&0xffff0000){ /* checks for 1.xxxxxxxxxxxxxxxx */
-      qi>>=1; qexp++; 
+      qi>>=1; qexp++;
     }else
       lsp_norm_asm(&qi,&qexp);
 
@@ -227,7 +227,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
     if(!(shift=MLOOP_1[(pi|qi)>>25]))
       if(!(shift=MLOOP_2[(pi|qi)>>19]))
 	shift=MLOOP_3[(pi|qi)>>16];
-    
+
     /* pi,qi normalized collectively, both tracked using qexp */
 
     if(m&1){
@@ -240,7 +240,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
       if(!(shift=MLOOP_1[(pi|qi)>>25]))
 	if(!(shift=MLOOP_2[(pi|qi)>>19]))
 	  shift=MLOOP_3[(pi|qi)>>16];
-      
+
       pi>>=shift;
       qi>>=shift;
       qexp+=shift-14*((m+1)>>1);
@@ -257,7 +257,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
 
       /* p*=p(1-w), q*=q(1+w), let normalization drift because it isn't
 	 worth tracking step by step */
-      
+
       pi>>=shift;
       qi>>=shift;
       qexp+=shift-7*m;
@@ -265,39 +265,39 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
       pi=((pi*pi)>>16);
       qi=((qi*qi)>>16);
       qexp=qexp*2+m;
-      
+
       pi*=(1<<14)-wi;
       qi*=(1<<14)+wi;
       qi=(qi+pi)>>14;
-      
+
     }
-    
+
 
     /* we've let the normalization drift because it wasn't important;
        however, for the lookup, things must be normalized again.  We
        need at most one right shift or a number of left shifts */
 
     if(qi&0xffff0000){ /* checks for 1.xxxxxxxxxxxxxxxx */
-      qi>>=1; qexp++; 
+      qi>>=1; qexp++;
     }else
       while(qi && !(qi&0x8000)){ /* checks for 0.0xxxxxxxxxxxxxxx or less*/
-	qi<<=1; qexp--; 
+	qi<<=1; qexp--;
       }
 
 #endif
 
     amp=vorbis_fromdBlook_i(ampi*                     /*  n.4         */
-			    vorbis_invsqlook_i(qi,qexp)- 
+			    vorbis_invsqlook_i(qi,qexp)-
 			                              /*  m.8, m+n<=8 */
 			    ampoffseti);              /*  8.12[0]     */
-    
+
 #ifdef _LOW_ACCURACY_
     amp>>=9;
 #endif
     curve[i]= MULT31_SHIFT15(curve[i],amp);
 
     while(++i<n){
-	
+
       /* line plot to get new f */
       ferr+=fdy;
       if(ferr>=fdx){
@@ -305,7 +305,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
 	f++;
       }
       f+=fbase;
-      
+
       if(f>=nextf)break;
 
       curve[i]= MULT31_SHIFT15(curve[i],amp);
@@ -315,7 +315,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
       map++;
 
       if(map+1<ln){
-	
+
 #ifdef _LOW_ACCURACY_
 	nextbark=((tBnyq1<<11)/ln*(map+1))>>12;
 #else
@@ -325,7 +325,7 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int n,int ln,
 	  (((nextbark&0x3fff)*
 	    (barklook[(nextbark>>14)+1]-barklook[nextbark>>14]))>>14);
 	if(f<=nextf)break;
-	
+
       }else{
 	nextf=9999999;
 	break;
@@ -356,14 +356,16 @@ vorbis_info_floor *floor0_info_unpack (vorbis_info *vi,oggpack_buffer *opb){
   info->ampbits=oggpack_read(opb,6);
   info->ampdB=oggpack_read(opb,8);
   info->numbooks=oggpack_read(opb,4)+1;
-  
+
   if(info->order<1)goto err_out;
   if(info->rate<1)goto err_out;
   if(info->barkmap<1)goto err_out;
-    
+  if(info->numbooks<1)goto err_out;
+
   for(j=0;j<info->numbooks;j++){
     info->books[j]=(char)(oggpack_read(opb,8));
-    if(info->books[j]>=ci->books)goto err_out;
+    if(info->books[j]<0 || info->books[j]>=ci->books)goto err_out;
+    if(ci->book_param->dim<1)goto err_out;
   }
 
   if(oggpack_eop(opb))goto err_out;
@@ -383,25 +385,25 @@ ogg_int32_t *floor0_inverse1(vorbis_dsp_state *vd,vorbis_info_floor *i,
 			     ogg_int32_t *lsp){
   vorbis_info_floor0 *info=(vorbis_info_floor0 *)i;
   int j,k;
-  
+
   int ampraw=oggpack_read(&vd->opb,info->ampbits);
   if(ampraw>0){ /* also handles the -1 out of data case */
     long maxval=(1<<info->ampbits)-1;
     int amp=((ampraw*info->ampdB)<<4)/maxval;
     int booknum=oggpack_read(&vd->opb,_ilog(info->numbooks));
-    
+
     if(booknum!=-1 && booknum<info->numbooks){ /* be paranoid */
       codec_setup_info  *ci=(codec_setup_info *)vd->vi->codec_setup;
       codebook *b=ci->book_param+info->books[booknum];
       ogg_int32_t last=0;
-            
+
       for(j=0;j<info->order;j+=b->dim)
 	if(vorbis_book_decodev_set(b,lsp+j,&vd->opb,b->dim,-24)==-1)goto eop;
       for(j=0;j<info->order;){
 	for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
 	last=lsp[j-1];
       }
-      
+
       lsp[info->order]=amp;
       return(lsp);
     }
@@ -414,7 +416,7 @@ int floor0_inverse2(vorbis_dsp_state *vd,vorbis_info_floor *i,
 			   ogg_int32_t *lsp,ogg_int32_t *out){
   vorbis_info_floor0 *info=(vorbis_info_floor0 *)i;
   codec_setup_info  *ci=(codec_setup_info *)vd->vi->codec_setup;
-  
+
   if(lsp){
     ogg_int32_t amp=lsp[info->order];