From 699d1778f89e1bec3903805c7e0430cd6d484ab5 Mon Sep 17 00:00:00 2001 From: Tim Terriberry Date: Thu, 14 Oct 2010 00:07:49 +0000 Subject: Port of r16181 from libvorbis. First half of fix for https://bugzilla.mozilla.org/show_bug.cgi?id=500254 Residue code was not checking that its partition books were books with specified/populated value mappings. git-svn-id: https://svn.xiph.org/trunk/Tremor@17522 0101bb08-14d6-0310-b084-bc0e0c8e3800 --- res012.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/res012.c b/res012.c index 83e27b9..5cfa2a5 100644 --- a/res012.c +++ b/res012.c @@ -110,8 +110,10 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){ info->booklist[j]=oggpack_read(opb,8); if(info->groupbook>=ci->books)goto errout; - for(j=0;jbooklist[j]>=ci->books)goto errout; + if(ci->book_param[info->booklist[j]]->maptype==0)goto errout; + } /* verify the phrasebook is not specifying an impossible or inconsistent partitioning scheme. */ -- cgit v1.2.1