From 80661a13c93a01f25b8df4e89fecad0eee69ddcc Mon Sep 17 00:00:00 2001 From: Monty Date: Mon, 18 Oct 2010 09:54:48 +0000 Subject: floor0 code could potentially use a book where the number of vals it needed to decode was not an integer number of dims wide. This caused it to overflow the output vector as the termination condition was in the outer loop of vorbis_book_decodev_set. None of the various vorbis_book_decodeXXXX calls internally guard against this case either, but in every other use the calling code does properly guard (and avoids putting more checks in the tight inner decode loop). For floor0, move the checks into the inner loop as there's little penalty for doing so. Add commentary indicating where guarding is done for each call variant. git-svn-id: https://svn.xiph.org/trunk/Tremor@17546 0101bb08-14d6-0310-b084-bc0e0c8e3800 --- floor0.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'floor0.c') diff --git a/floor0.c b/floor0.c index 50ff5d1..9f3ef56 100644 --- a/floor0.c +++ b/floor0.c @@ -397,10 +397,9 @@ static void *floor0_inverse1(vorbis_block *vb,vorbis_look_floor *i){ ogg_int32_t last=0; ogg_int32_t *lsp=(ogg_int32_t *)_vorbis_block_alloc(vb,sizeof(*lsp)*(look->m+1)); - for(j=0;jm;j+=b->dim) - if(vorbis_book_decodev_set(b,lsp+j,&vb->opb,b->dim,-24)==-1)goto eop; + if(vorbis_book_decodev_set(b,lsp,&vb->opb,look->m,-24)==-1)goto eop; for(j=0;jm;){ - for(k=0;kdim;k++,j++)lsp[j]+=last; + for(k=0;jm && kdim;k++,j++)lsp[j]+=last; last=lsp[j-1]; } -- cgit v1.2.1