diff options
author | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 00:23:54 +0000 |
---|---|---|
committer | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 00:23:54 +0000 |
commit | ba51e86cb277cea805ddc2506b63d01ddd919763 (patch) | |
tree | ef0993e55c311211c5e0b520ca325376c42523a9 | |
parent | 6e25b5c1e60f1b5d7d6ad3f17ef1490b0d72b00b (diff) | |
download | tremor-ba51e86cb277cea805ddc2506b63d01ddd919763.tar.gz |
Port r16218 from libvorbis.
Fix for https://bugzilla.mozilla.org/show_bug.cgi?id=501279
git-svn-id: https://svn.xiph.org/trunk/Tremor@17524 0101bb08-14d6-0310-b084-bc0e0c8e3800
-rw-r--r-- | res012.c | 19 |
1 files changed, 15 insertions, 4 deletions
@@ -98,16 +98,27 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){ info->partitions=oggpack_read(opb,6)+1; info->groupbook=oggpack_read(opb,8); + /* check for premature EOP */ + if(info->groupbook<0)goto errout; + for(j=0;j<info->partitions;j++){ int cascade=oggpack_read(opb,3); - if(oggpack_read(opb,1)) - cascade|=(oggpack_read(opb,5)<<3); + int cflag=oggpack_read(opb,1); + if(cflag<0) goto errout; + if(cflag){ + int c=oggpack_read(opb,5); + if(c<0) goto errout; + cascade|=(c<<3); + } info->secondstages[j]=cascade; acc+=icount(cascade); } - for(j=0;j<acc;j++) - info->booklist[j]=oggpack_read(opb,8); + for(j=0;j<acc;j++){ + int book=oggpack_read(opb,8); + if(book<0) goto errout; + info->booklist[j]=book; + } if(info->groupbook>=ci->books)goto errout; for(j=0;j<acc;j++){ |