Port the rest of r16222 from libvorbis.

Commit additional hardening to setup packet decode.

[Import changes from Tremor (28854b5 2010-10-14)]

1 files changed, 15 insertions, 8 deletions

diff --git a/mapping0.c b/mapping0.c
index de9f7db..f804bec 100644
--- a/mapping0.c
+++ b/mapping0.c
@@ -49,17 +49,23 @@ static int ilog(unsigned int v){
 /* also responsible for range checking */
 int mapping_info_unpack(vorbis_info_mapping *info,vorbis_info *vi,
 			oggpack_buffer *opb){
-  int i;
+  int i,b;
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   memset(info,0,sizeof(*info));
 
-  if(oggpack_read(opb,1))
+  b=oggpack_read(opb,1);
+  if(b<0)goto err_out;
+  if(b){
     info->submaps=oggpack_read(opb,4)+1;
-  else
+    if(info->submaps<=0)goto err_out;
+  }else
     info->submaps=1;
 
-  if(oggpack_read(opb,1)){
+  b=oggpack_read(opb,1);
+  if(b<0)goto err_out;
+  if(b){
     info->coupling_steps=oggpack_read(opb,8)+1;
+    if(info->coupling_steps<=0)goto err_out;
     info->coupling=
       _ogg_malloc(info->coupling_steps*sizeof(*info->coupling));
     
@@ -76,14 +82,14 @@ int mapping_info_unpack(vorbis_info_mapping *info,vorbis_info *vi,
 
   }
 
-  if(oggpack_read(opb,2)>0)goto err_out; /* 2,3:reserved */
+  if(oggpack_read(opb,2)!=0)goto err_out; /* 2,3:reserved */
     
   if(info->submaps>1){
     info->chmuxlist=_ogg_malloc(sizeof(*info->chmuxlist)*vi->channels);
     if (!info->chmuxlist) goto err_out;
     for(i=0;i<vi->channels;i++){
       info->chmuxlist[i]=(unsigned char)oggpack_read(opb,4);
-      if(info->chmuxlist[i]>=info->submaps)goto err_out;
+      if(info->chmuxlist[i]>=info->submaps || info->chmuxlist[i]<0)goto err_out;
     }
   }
 
@@ -92,9 +98,10 @@ int mapping_info_unpack(vorbis_info_mapping *info,vorbis_info *vi,
   for(i=0;i<info->submaps;i++){
     int temp=oggpack_read(opb,8);
     info->submaplist[i].floor=(char)oggpack_read(opb,8);
-    if(info->submaplist[i].floor>=ci->floors)goto err_out;
+    if(info->submaplist[i].floor>=ci->floors || info->submaplist[i].floor<0)goto err_out;
     info->submaplist[i].residue=(char)oggpack_read(opb,8);
-    if(info->submaplist[i].residue>=ci->residues)goto err_out;
+    if(info->submaplist[i].residue>=ci->residues || info->submaplist[i].residue<0)
+      goto err_out;
   }
 
   return 0;