media/libtremor/bug719612.patch@6474c204b198 (annotated)
media/libtremor/bug719612.patch
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c |
| michael@0 | 2 | --- a/media/libtremor/lib/tremor_floor1.c |
| michael@0 | 3 | +++ b/media/libtremor/lib/tremor_floor1.c |
| michael@0 | 4 | @@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack |
| michael@0 | 5 | |
| michael@0 | 6 | /* read the post list */ |
| michael@0 | 7 | info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */ |
| michael@0 | 8 | rangebits=oggpack_read(opb,4); |
| michael@0 | 9 | if(rangebits<0)goto err_out; |
| michael@0 | 10 | |
| michael@0 | 11 | for(j=0,k=0;j<info->partitions;j++){ |
| michael@0 | 12 | count+=info->class_dim[info->partitionclass[j]]; |
| michael@0 | 13 | + if(count>VIF_POSIT)goto err_out; |
| michael@0 | 14 | for(;k<count;k++){ |
| michael@0 | 15 | int t=info->postlist[k+2]=oggpack_read(opb,rangebits); |
| michael@0 | 16 | if(t<0 || t>=(1<<rangebits)) |
| michael@0 | 17 | goto err_out; |
| michael@0 | 18 | } |
| michael@0 | 19 | } |
| michael@0 | 20 | info->postlist[0]=0; |
| michael@0 | 21 | info->postlist[1]=1<<rangebits; |
