Port r17027 from libvorbis.

Apply patches from Trac #1638, additional application hardening.


git-svn-id: https://svn.xiph.org/trunk/Tremor@17529 0101bb08-14d6-0310-b084-bc0e0c8e3800

1 files changed, 13 insertions, 5 deletions

diff --git a/synthesis.c b/synthesis.c
index 60d5501..38c3eb8 100644
--- a/synthesis.c
+++ b/synthesis.c
@@ -25,13 +25,17 @@
 #include "block.h"
 
 static int _vorbis_synthesis1(vorbis_block *vb,ogg_packet *op,int decodep){
-  vorbis_dsp_state     *vd=vb->vd;
-  private_state        *b=(private_state *)vd->backend_state;
-  vorbis_info          *vi=vd->vi;
-  codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
-  oggpack_buffer       *opb=&vb->opb;
+  vorbis_dsp_state     *vd= vb ? vb->vd : 0;
+  private_state        *b= vd ? (private_state *)vd->backend_state: 0;
+  vorbis_info          *vi= vd ? vd->vi : 0;
+  codec_setup_info     *ci= vi ? (codec_setup_info *)vi->codec_setup : 0;
+  oggpack_buffer       *opb=vb ? &vb->opb : 0;
   int                   type,mode,i;
  
+  if (!vd || !b || !vi || !ci || !opb) {
+    return OV_EBADPACKET;
+  }
+
   /* first things first.  Make sure decode is ready */
   _vorbis_block_ripcord(vb);
   oggpack_readinit(opb,op->packet,op->bytes);
@@ -47,6 +51,10 @@ static int _vorbis_synthesis1(vorbis_block *vb,ogg_packet *op,int decodep){
   if(mode==-1)return(OV_EBADPACKET);
   
   vb->mode=mode;
+  if(!ci->mode_param[mode]){
+    return(OV_EBADPACKET);
+  }
+
   vb->W=ci->mode_param[mode]->blockflag;
   if(vb->W){
     vb->lW=oggpack_read(opb,1);