[xiph-commits] r17524 - trunk/Tremor

[tterribe at svn.xiph.org]

Author: tterribe
Date: 2010-10-13 17:23:54 -0700 (Wed, 13 Oct 2010)
New Revision: 17524

Modified:
   trunk/Tremor/res012.c
Log:
Port r16218 from libvorbis.

Fix for https://bugzilla.mozilla.org/show_bug.cgi?id=501279


Modified: trunk/Tremor/res012.c
===================================================================
--- trunk/Tremor/res012.c	2010-10-14 00:17:09 UTC (rev 17523)
+++ trunk/Tremor/res012.c	2010-10-14 00:23:54 UTC (rev 17524)
@@ -98,16 +98,27 @@
   info->partitions=oggpack_read(opb,6)+1;
   info->groupbook=oggpack_read(opb,8);
 
+  /* check for premature EOP */
+  if(info->groupbook<0)goto errout;
+
   for(j=0;j<info->partitions;j++){
     int cascade=oggpack_read(opb,3);
-    if(oggpack_read(opb,1))
-      cascade|=(oggpack_read(opb,5)<<3);
+    int cflag=oggpack_read(opb,1);
+    if(cflag<0) goto errout;
+    if(cflag){
+      int c=oggpack_read(opb,5);
+      if(c<0) goto errout;
+      cascade|=(c<<3);
+    }
     info->secondstages[j]=cascade;
 
     acc+=icount(cascade);
   }
-  for(j=0;j<acc;j++)
-    info->booklist[j]=oggpack_read(opb,8);
+  for(j=0;j<acc;j++){
+    int book=oggpack_read(opb,8);
+    if(book<0) goto errout;
+    info->booklist[j]=book;
+  }
 
   if(info->groupbook>=ci->books)goto errout;
   for(j=0;j<acc;j++){