Bug 498824 - libtheora update - r=roc
authorTim Terriberry <tterribe@email.unc.edu>
Fri, 19 Jun 2009 15:12:54 +1200
changeset 29343 1a24562b09ad4897859a47cb40e4c9a9e782540a
parent 29342 e83515363df8f8ef0fc10267721a4208d71666f7
child 29344 aebc04ab967d7bf0728516a099f32ca33d08dd90
push id7586
push usercdouble@mozilla.com
push dateFri, 19 Jun 2009 06:25:19 +0000
treeherdermozilla-central@592ca0329827 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs498824
milestone1.9.2a1pre
Bug 498824 - libtheora update - r=roc
media/libtheora/README_MOZILLA
media/libtheora/bug498824.patch
media/libtheora/lib/dec/decinfo.c
media/libtheora/update.sh
--- a/media/libtheora/README_MOZILLA
+++ b/media/libtheora/README_MOZILLA
@@ -9,8 +9,9 @@ Bug 455357 - WinCE LibTheora Pre-defined
   This patch is needed for building WinCE / WinMobile because the 
   Mozilla WinCE Shunt Library currently includes windows.h header file,
   which causes a conflict with local variables in the oc_dering_block()
   function.  This issue should be cleared up soon, with a reworking of 
   the WinCE Shunt Library (Bug 456788 - reduce windows ce shunt impact).  
   Until then, this simple patch allows WinCE to finish compiling.
 
 bug498815.patch: Fix for this bug from libtheora svn r16143.
+bug498824.patch: Fix for this bug from libtheora thusnelda branch.
new file mode 100644
--- /dev/null
+++ b/media/libtheora/bug498824.patch
@@ -0,0 +1,55 @@
+diff --git a/media/libtheora/lib/dec/decinfo.c b/media/libtheora/lib/dec/decinfo.c
+index e51d63e..d08d6b6 100644
+--- a/media/libtheora/lib/dec/decinfo.c
++++ b/media/libtheora/lib/dec/decinfo.c
+@@ -11,7 +11,7 @@
+  ********************************************************************
+ 
+   function:
+-    last mod: $Id: decinfo.c 15400 2008-10-15 12:10:58Z tterribe $
++    last mod: $Id$
+ 
+  ********************************************************************/
+ 
+@@ -111,14 +111,15 @@ static int oc_comment_unpack(oggpack_buffer *_opb,th_comment *_tc){
+   int  i;
+   /*Read the vendor string.*/
+   len=oc_unpack_length(_opb);
+-  if(len<0||theorapackB_bytes(_opb)+len>_opb->storage)return TH_EBADHEADER;
++  if(len<0||len>_opb->storage-theorapackB_bytes(_opb))return TH_EBADHEADER;
+   _tc->vendor=_ogg_malloc((size_t)len+1);
+   oc_unpack_octets(_opb,_tc->vendor,len);
+   _tc->vendor[len]='\0';
+   /*Read the user comments.*/
+   _tc->comments=(int)oc_unpack_length(_opb);
+-  if(_tc->comments<0||_tc->comments>(LONG_MAX>>2)||
+-   theorapackB_bytes(_opb)+((long)_tc->comments<<2)>_opb->storage){
++  len=_tc->comments;
++  if(len<0||len>(LONG_MAX>>2)||len<<2>_opb->storage-theorapackB_bytes(_opb)){
++    _tc->comments=0;
+     return TH_EBADHEADER;
+   }
+   _tc->comment_lengths=(int *)_ogg_malloc(
+@@ -127,7 +128,7 @@ static int oc_comment_unpack(oggpack_buffer *_opb,th_comment *_tc){
+    _tc->comments*sizeof(_tc->user_comments[0]));
+   for(i=0;i<_tc->comments;i++){
+     len=oc_unpack_length(_opb);
+-    if(len<0||theorapackB_bytes(_opb)+len>_opb->storage){
++    if(len<0||len>_opb->storage-theorapackB_bytes(_opb)){
+       _tc->comments=i;
+       return TH_EBADHEADER;
+     }
+@@ -224,12 +225,10 @@ static int oc_dec_headerin(oggpack_buffer *_opb,th_info *_info,
+ int th_decode_headerin(th_info *_info,th_comment *_tc,
+  th_setup_info **_setup,ogg_packet *_op){
+   oggpack_buffer opb;
+-  int            ret;
+   if(_op==NULL)return TH_EBADHEADER;
+   if(_info==NULL)return TH_EFAULT;
+   theorapackB_readinit(&opb,_op->packet,_op->bytes);
+-  ret=oc_dec_headerin(&opb,_info,_tc,_setup,_op);
+-  return ret;
++  return oc_dec_headerin(&opb,_info,_tc,_setup,_op);
+ }
+ 
+ void th_setup_free(th_setup_info *_setup){
--- a/media/libtheora/lib/dec/decinfo.c
+++ b/media/libtheora/lib/dec/decinfo.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE Theora SOURCE CODE IS COPYRIGHT (C) 2002-2007                *
  * by the Xiph.Org Foundation and contributors http://www.xiph.org/ *
  *                                                                  *
  ********************************************************************
 
   function:
-    last mod: $Id: decinfo.c 15400 2008-10-15 12:10:58Z tterribe $
+    last mod: $Id$
 
  ********************************************************************/
 
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
 #include "decint.h"
 
@@ -106,33 +106,34 @@ static int oc_info_unpack(oggpack_buffer
   return 0;
 }
 
 static int oc_comment_unpack(oggpack_buffer *_opb,th_comment *_tc){
   long len;
   int  i;
   /*Read the vendor string.*/
   len=oc_unpack_length(_opb);
-  if(len<0||theorapackB_bytes(_opb)+len>_opb->storage)return TH_EBADHEADER;
+  if(len<0||len>_opb->storage-theorapackB_bytes(_opb))return TH_EBADHEADER;
   _tc->vendor=_ogg_malloc((size_t)len+1);
   oc_unpack_octets(_opb,_tc->vendor,len);
   _tc->vendor[len]='\0';
   /*Read the user comments.*/
   _tc->comments=(int)oc_unpack_length(_opb);
-  if(_tc->comments<0||_tc->comments>(LONG_MAX>>2)||
-   theorapackB_bytes(_opb)+((long)_tc->comments<<2)>_opb->storage){
+  len=_tc->comments;
+  if(len<0||len>(LONG_MAX>>2)||len<<2>_opb->storage-theorapackB_bytes(_opb)){
+    _tc->comments=0;
     return TH_EBADHEADER;
   }
   _tc->comment_lengths=(int *)_ogg_malloc(
    _tc->comments*sizeof(_tc->comment_lengths[0]));
   _tc->user_comments=(char **)_ogg_malloc(
    _tc->comments*sizeof(_tc->user_comments[0]));
   for(i=0;i<_tc->comments;i++){
     len=oc_unpack_length(_opb);
-    if(len<0||theorapackB_bytes(_opb)+len>_opb->storage){
+    if(len<0||len>_opb->storage-theorapackB_bytes(_opb)){
       _tc->comments=i;
       return TH_EBADHEADER;
     }
     _tc->comment_lengths[i]=len;
     _tc->user_comments[i]=_ogg_malloc((size_t)len+1);
     oc_unpack_octets(_opb,_tc->user_comments[i],len);
     _tc->user_comments[i][len]='\0';
   }
@@ -219,22 +220,20 @@ static int oc_dec_headerin(oggpack_buffe
 
 
 /*Decodes one header packet.
   This should be called repeatedly with the packets at the beginning of the
    stream until it returns 0.*/
 int th_decode_headerin(th_info *_info,th_comment *_tc,
  th_setup_info **_setup,ogg_packet *_op){
   oggpack_buffer opb;
-  int            ret;
   if(_op==NULL)return TH_EBADHEADER;
   if(_info==NULL)return TH_EFAULT;
   theorapackB_readinit(&opb,_op->packet,_op->bytes);
-  ret=oc_dec_headerin(&opb,_info,_tc,_setup,_op);
-  return ret;
+  return oc_dec_headerin(&opb,_info,_tc,_setup,_op);
 }
 
 void th_setup_free(th_setup_info *_setup){
   if(_setup!=NULL){
     oc_setup_clear(_setup);
     _ogg_free(_setup);
   }
 }
--- a/media/libtheora/update.sh
+++ b/media/libtheora/update.sh
@@ -48,9 +48,11 @@ cp $1/lib/dec/decode.c ./lib/dec/decode.
 cp $1/lib/dec/dequant.c ./lib/dec/dequant.c
 cp $1/lib/dec/quant.h ./lib/dec/quant.h
 cp $1/lib/dec/dequant.h ./lib/dec/dequant.h
 cp $1/lib/internal.h ./lib/internal.h
 cp $1/include/theora/theora.h ./include/theora/theora.h
 cp $1/include/theora/theoradec.h ./include/theora/theoradec.h
 cp $1/include/theora/codec.h ./include/theora/codec.h
 patch -p3 <455357_wince_local_variable_macro_clash_patch
+patch -p3 <bug498815.patch
+patch -p3 <bug498824.patch
 patch -p0 <bug498770.patch