diff options
author | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
---|---|---|
committer | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
commit | 28854b5669212379c190640063be53b19f12ab88 (patch) | |
tree | 01f5b70ac3c76888b59b10c8f446fbc576845166 /floor1.c | |
parent | ba51e86cb277cea805ddc2506b63d01ddd919763 (diff) | |
download | tremor-28854b5669212379c190640063be53b19f12ab88.tar.gz |
Port the rest of r16222 from libvorbis.
Commit additional hardening to setup packet decode.
git-svn-id: https://svn.xiph.org/trunk/Tremor@17525 0101bb08-14d6-0310-b084-bc0e0c8e3800
Diffstat (limited to 'floor1.c')
-rw-r--r-- | floor1.c | 2 |
1 files changed, 2 insertions, 0 deletions
@@ -81,6 +81,7 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){ info->partitions=oggpack_read(opb,5); /* only 0 to 31 legal */ for(j=0;j<info->partitions;j++){ info->partitionclass[j]=oggpack_read(opb,4); /* only 0 to 15 legal */ + if(info->partitionclass[j]<0)goto err_out; if(maxclass<info->partitionclass[j])maxclass=info->partitionclass[j]; } @@ -103,6 +104,7 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){ /* read the post list */ info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */ rangebits=oggpack_read(opb,4); + if(rangebits<0)goto err_out; for(j=0,k=0;j<info->partitions;j++){ count+=info->class_dim[info->partitionclass[j]]; |