Fix decoder handling of floor0 when the LSP order is 1.

Header setup allows the LSP order to be as low as one, but the code in
 vorbis_lsp_to_curve() assumed it was at least two.
This wasn't terrible in libvorbis... it would multiply a nonsense (but defined)
 value into the output, and nothing more.
In Tremor, it referenced several completely undefined (stack) values, which
 could cause out-of-bounds lookup table accesses and crashes.


git-svn-id: https://svn.xiph.org/trunk/Tremor@17538 0101bb08-14d6-0310-b084-bc0e0c8e3800

1 files changed, 13 insertions, 10 deletions

diff --git a/floor0.c b/floor0.c
index 3f17950..5c58f77 100644
--- a/floor0.c
+++ b/floor0.c
@@ -197,16 +197,19 @@ void vorbis_lsp_to_curve(ogg_int32_t *curve,int *map,int n,int ln,
 
 #else
 
-    qi*=labs(ilsp[0]-wi);
-    pi*=labs(ilsp[1]-wi);
-
-    for(j=3;j<m;j+=2){
-      if(!(shift=MLOOP_1[(pi|qi)>>25]))
-	if(!(shift=MLOOP_2[(pi|qi)>>19]))
-	  shift=MLOOP_3[(pi|qi)>>16];
-      qi=(qi>>shift)*labs(ilsp[j-1]-wi);
-      pi=(pi>>shift)*labs(ilsp[j]-wi);
-      qexp+=shift;
+    j=1;
+    if(m>1){
+      qi*=labs(ilsp[0]-wi);
+      pi*=labs(ilsp[1]-wi);
+
+      for(j+=2;j<m;j+=2){
+        if(!(shift=MLOOP_1[(pi|qi)>>25]))
+          if(!(shift=MLOOP_2[(pi|qi)>>19]))
+            shift=MLOOP_3[(pi|qi)>>16];
+        qi=(qi>>shift)*labs(ilsp[j-1]-wi);
+        pi=(pi>>shift)*labs(ilsp[j]-wi);
+        qexp+=shift;
+      }
     }
     if(!(shift=MLOOP_1[(pi|qi)>>25]))
       if(!(shift=MLOOP_2[(pi|qi)>>19]))