michael@0: diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c
michael@0: --- a/media/libtremor/lib/tremor_floor1.c
michael@0: +++ b/media/libtremor/lib/tremor_floor1.c
michael@0: @@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack 
michael@0:  
michael@0:    /* read the post list */
michael@0:    info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */ 
michael@0:    rangebits=oggpack_read(opb,4);
michael@0:    if(rangebits<0)goto err_out;
michael@0:  
michael@0:    for(j=0,k=0;j<info->partitions;j++){
michael@0:      count+=info->class_dim[info->partitionclass[j]]; 
michael@0: +    if(count>VIF_POSIT)goto err_out;
michael@0:      for(;k<count;k++){
michael@0:        int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
michael@0:        if(t<0 || t>=(1<<rangebits))
michael@0:  	goto err_out;
michael@0:      }
michael@0:    }
michael@0:    info->postlist[0]=0;
michael@0:    info->postlist[1]=1<<rangebits;