Bug 600776 - Update in-tree libvorbis to 1.3.2. rs=doublec a=blocking2.0:final+
authorMatthew Gregan <kinetik@flim.org>
Wed, 03 Nov 2010 11:54:28 +1300
changeset 57487 8066a37cd0c95c06b109061c61794dc64d761446
parent 57486 c1351e1799b8f0aa39c55263755367b452312217
child 57488 72cd1af86528cb8a3b8538d0b15989191f6d423f
push id16942
push usermgregan@mozilla.com
push dateSun, 14 Nov 2010 23:07:44 +0000
treeherdermozilla-central@8066a37cd0c9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdoublec, blocking2.0
bugs600776
milestone2.0b8pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 600776 - Update in-tree libvorbis to 1.3.2. rs=doublec a=blocking2.0:final+
media/libvorbis/README_MOZILLA
media/libvorbis/bug487519.patch
media/libvorbis/lib/highlevel.h
media/libvorbis/lib/vorbis_block.c
media/libvorbis/lib/vorbis_codebook.c
media/libvorbis/lib/vorbis_floor0.c
media/libvorbis/lib/vorbis_floor1.c
media/libvorbis/lib/vorbis_info.c
media/libvorbis/lib/vorbis_lsp.c
media/libvorbis/lib/vorbis_psy.c
media/libvorbis/lib/vorbis_res0.c
media/libvorbis/lib/vorbis_synthesis.c
media/libvorbis/update.sh
--- a/media/libvorbis/README_MOZILLA
+++ b/media/libvorbis/README_MOZILLA
@@ -1,12 +1,11 @@
 The source from this directory was copied from the libvorbis
 subversion repository using the update.sh script. The only changes
 made were those applied by update.sh and the addition/upate of
 Makefile.in files for the Mozilla build system.
 
-The upstream release used was libvorbis 1.3.1.
+The upstream release used was libvorbis 1.3.2 (SVN r17614).
 
 Some files are renamed during the copy to prevent clashes with object
 file names with other Mozilla libraries.
 
 alloca.diff - Bug 469639 - Failed to build firefox trunk on OpenSolaris
-bug487519.patch: fix for bug 487519.
deleted file mode 100644
--- a/media/libvorbis/bug487519.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/media/libvorbis/lib/vorbis_synthesis.c b/media/libvorbis/lib/vorbis_synthesis.c
-index 8872f57..b7b2399 100644
---- a/media/libvorbis/lib/vorbis_synthesis.c
-+++ b/media/libvorbis/lib/vorbis_synthesis.c
-@@ -43,9 +43,14 @@ int vorbis_synthesis(vorbis_block *vb,ogg_packet *op){
- 
-   /* read our mode and pre/post windowsize */
-   mode=oggpack_read(opb,b->modebits);
--  if(mode==-1)return(OV_EBADPACKET);
-+  if(mode==-1) {
-+    return(OV_EBADPACKET);
-+  }
- 
-   vb->mode=mode;
-+  if(!ci->mode_param[mode]) {
-+    return(OV_EBADPACKET); 
-+  }
-   vb->W=ci->mode_param[mode]->blockflag;
-   if(vb->W){
- 
--- a/media/libvorbis/lib/highlevel.h
+++ b/media/libvorbis/lib/highlevel.h
@@ -5,18 +5,18 @@
  * GOVERNED BY A BSD-STYLE SOURCE LICENSE INCLUDED WITH THIS SOURCE *
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
- function: highlevel encoder setup struct seperated out for vorbisenc clarity
- last mod: $Id: highlevel.h 16995 2010-03-23 03:44:44Z xiphmont $
+ function: highlevel encoder setup struct separated out for vorbisenc clarity
+ last mod: $Id: highlevel.h 17195 2010-05-05 21:49:51Z giles $
 
  ********************************************************************/
 
 typedef struct highlevel_byblocktype {
   double tone_mask_setting;
   double tone_peaklimit_setting;
   double noise_bias_setting;
   double noise_compand_setting;
--- a/media/libvorbis/lib/vorbis_block.c
+++ b/media/libvorbis/lib/vorbis_block.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: PCM data vector blocking, windowing and dis/reassembly
- last mod: $Id: block.c 16330 2009-07-24 01:58:50Z xiphmont $
+ last mod: $Id: block.c 17561 2010-10-23 10:34:24Z xiphmont $
 
  Handle windowing, overlap-add, etc of the PCM vectors.  This is made
  more amusing by Vorbis' current two allowed block sizes.
 
  ********************************************************************/
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -227,26 +227,27 @@ static int _vds_shared_init(vorbis_dsp_s
                    &ci->psy_g_param,
                    ci->blocksizes[ci->psy_param[i]->blockflag]/2,
                    vi->rate);
     }
 
     v->analysisp=1;
   }else{
     /* finish the codebooks */
-    if(!ci->fullbooks)
+    if(!ci->fullbooks){
       ci->fullbooks=_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
-    for(i=0;i<ci->books;i++){
-      if(ci->book_param[i]==NULL)
-        goto abort_books;
-      if(vorbis_book_init_decode(ci->fullbooks+i,ci->book_param[i]))
-        goto abort_books;
+      for(i=0;i<ci->books;i++){
+        if(ci->book_param[i]==NULL)
+          goto abort_books;
+        if(vorbis_book_init_decode(ci->fullbooks+i,ci->book_param[i]))
+          goto abort_books;
         /* decode codebooks are now standalone after init */
-      vorbis_staticbook_destroy(ci->book_param[i]);
-      ci->book_param[i]=NULL;
+        vorbis_staticbook_destroy(ci->book_param[i]);
+        ci->book_param[i]=NULL;
+      }
     }
   }
 
   /* initialize the storage vectors. blocksize[1] is small for encode,
      but the correct size for decode */
   v->pcm_storage=ci->blocksizes[1];
   v->pcm=_ogg_malloc(vi->channels*sizeof(*v->pcm));
   v->pcmret=_ogg_malloc(vi->channels*sizeof(*v->pcmret));
@@ -854,27 +855,42 @@ int vorbis_synthesis_blockin(vorbis_dsp_
     if(vb->granulepos!=-1){ /* only set if we have a position to set to */
 
       v->granulepos=vb->granulepos;
 
       /* is this a short page? */
       if(b->sample_count>v->granulepos){
         /* corner case; if this is both the first and last audio page,
            then spec says the end is cut, not beginning */
+       long extra=b->sample_count-vb->granulepos;
+
+        /* we use ogg_int64_t for granule positions because a
+           uint64 isn't universally available.  Unfortunately,
+           that means granposes can be 'negative' and result in
+           extra being negative */
+        if(extra<0)
+          extra=0;
+
         if(vb->eofflag){
           /* trim the end */
-          /* no preceeding granulepos; assume we started at zero (we'd
+          /* no preceding granulepos; assume we started at zero (we'd
              have to in a short single-page stream) */
           /* granulepos could be -1 due to a seek, but that would result
              in a long count, not short count */
 
-          v->pcm_current-=(b->sample_count-v->granulepos)>>hs;
+          /* Guard against corrupt/malicious frames that set EOP and
+             a backdated granpos; don't rewind more samples than we
+             actually have */
+          if(extra > (v->pcm_current - v->pcm_returned)<<hs)
+            extra = (v->pcm_current - v->pcm_returned)<<hs;
+
+          v->pcm_current-=extra>>hs;
         }else{
           /* trim the beginning */
-          v->pcm_returned+=(b->sample_count-v->granulepos)>>hs;
+          v->pcm_returned+=extra>>hs;
           if(v->pcm_returned>v->pcm_current)
             v->pcm_returned=v->pcm_current;
         }
 
       }
 
     }
   }else{
@@ -882,16 +898,30 @@ int vorbis_synthesis_blockin(vorbis_dsp_
     if(vb->granulepos!=-1 && v->granulepos!=vb->granulepos){
 
       if(v->granulepos>vb->granulepos){
         long extra=v->granulepos-vb->granulepos;
 
         if(extra)
           if(vb->eofflag){
             /* partial last frame.  Strip the extra samples off */
+
+            /* Guard against corrupt/malicious frames that set EOP and
+               a backdated granpos; don't rewind more samples than we
+               actually have */
+            if(extra > (v->pcm_current - v->pcm_returned)<<hs)
+              extra = (v->pcm_current - v->pcm_returned)<<hs;
+
+            /* we use ogg_int64_t for granule positions because a
+               uint64 isn't universally available.  Unfortunately,
+               that means granposes can be 'negative' and result in
+               extra being negative */
+            if(extra<0)
+              extra=0;
+
             v->pcm_current-=extra>>hs;
           } /* else {Shouldn't happen *unless* the bitstream is out of
                spec.  Either way, believe the bitstream } */
       } /* else {Shouldn't happen *unless* the bitstream is out of
            spec.  Either way, believe the bitstream } */
       v->granulepos=vb->granulepos;
     }
   }
--- a/media/libvorbis/lib/vorbis_codebook.c
+++ b/media/libvorbis/lib/vorbis_codebook.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: basic codebook pack/unpack/code/decode operations
- last mod: $Id: codebook.c 17030 2010-03-25 06:52:55Z xiphmont $
+ last mod: $Id: codebook.c 17553 2010-10-21 17:54:26Z tterribe $
 
  ********************************************************************/
 
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>
 #include <ogg/ogg.h>
 #include "vorbis/codec.h"
@@ -158,22 +158,27 @@ static_codebook *vorbis_staticbook_unpac
   s->dim=oggpack_read(opb,16);
   s->entries=oggpack_read(opb,24);
   if(s->entries==-1)goto _eofout;
 
   if(_ilog(s->dim)+_ilog(s->entries)>24)goto _eofout;
 
   /* codeword ordering.... length ordered or unordered? */
   switch((int)oggpack_read(opb,1)){
-  case 0:
+  case 0:{
+    long unused;
+    /* allocated but unused entries? */
+    unused=oggpack_read(opb,1);
+    if((s->entries*(unused?1:5)+7)>>3>opb->storage-oggpack_bytes(opb))
+      goto _eofout;
     /* unordered */
     s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
 
     /* allocated but unused entries? */
-    if(oggpack_read(opb,1)){
+    if(unused){
       /* yes, unused entries */
 
       for(i=0;i<s->entries;i++){
         if(oggpack_read(opb,1)){
           long num=oggpack_read(opb,5);
           if(num==-1)goto _eofout;
           s->lengthlist[i]=num+1;
         }else
@@ -184,27 +189,33 @@ static_codebook *vorbis_staticbook_unpac
       for(i=0;i<s->entries;i++){
         long num=oggpack_read(opb,5);
         if(num==-1)goto _eofout;
         s->lengthlist[i]=num+1;
       }
     }
 
     break;
+  }
   case 1:
     /* ordered */
     {
       long length=oggpack_read(opb,5)+1;
+      if(length==0)goto _eofout;
       s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
 
       for(i=0;i<s->entries;){
         long num=oggpack_read(opb,_ilog(s->entries-i));
         if(num==-1)goto _eofout;
+        if(length>32 || num>s->entries-i ||
+           (num>0 && (num-1)>>(length-1)>1)){
+          goto _errout;
+        }
         if(length>32)goto _errout;
-        for(j=0;j<num && i<s->entries;j++,i++)
+        for(j=0;j<num;j++,i++)
           s->lengthlist[i]=length;
         length++;
       }
     }
     break;
   default:
     /* EOF */
     goto _eofout;
@@ -232,16 +243,18 @@ static_codebook *vorbis_staticbook_unpac
         quantvals=(s->dim==0?0:_book_maptype1_quantvals(s));
         break;
       case 2:
         quantvals=s->entries*s->dim;
         break;
       }
 
       /* quantized values */
+      if((quantvals*s->q_quant+7>>3)>opb->storage-oggpack_bytes(opb))
+        goto _eofout;
       s->quantlist=_ogg_malloc(sizeof(*s->quantlist)*quantvals);
       for(i=0;i<quantvals;i++)
         s->quantlist[i]=oggpack_read(opb,s->q_quant);
 
       if(quantvals&&s->quantlist[quantvals-1]==-1)goto _eofout;
     }
     break;
   default:
--- a/media/libvorbis/lib/vorbis_floor0.c
+++ b/media/libvorbis/lib/vorbis_floor0.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: floor backend 0 implementation
- last mod: $Id: floor0.c 16227 2009-07-08 06:58:46Z xiphmont $
+ last mod: $Id: floor0.c 17558 2010-10-22 00:24:41Z tterribe $
 
  ********************************************************************/
 
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>
 #include <ogg/ogg.h>
 #include "vorbis/codec.h"
@@ -86,16 +86,18 @@ static vorbis_info_floor *floor0_unpack 
   if(info->order<1)goto err_out;
   if(info->rate<1)goto err_out;
   if(info->barkmap<1)goto err_out;
   if(info->numbooks<1)goto err_out;
 
   for(j=0;j<info->numbooks;j++){
     info->books[j]=oggpack_read(opb,8);
     if(info->books[j]<0 || info->books[j]>=ci->books)goto err_out;
+    if(ci->book_param[info->books[j]]->maptype==0)goto err_out;
+    if(ci->book_param[info->books[j]]->dim<1)goto err_out;
   }
   return(info);
 
  err_out:
   floor0_free_info(info);
   return(NULL);
 }
 
--- a/media/libvorbis/lib/vorbis_floor1.c
+++ b/media/libvorbis/lib/vorbis_floor1.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: floor backend 1 implementation
- last mod: $Id: floor1.c 17079 2010-03-26 06:51:41Z xiphmont $
+ last mod: $Id: floor1.c 17555 2010-10-21 18:14:51Z tterribe $
 
  ********************************************************************/
 
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>
 #include <ogg/ogg.h>
 #include "vorbis/codec.h"
@@ -1030,17 +1030,17 @@ static void *floor1_inverse1(vorbis_bloc
         }else{
           if(val&1){
             val= -((val+1)>>1);
           }else{
             val>>=1;
           }
         }
 
-        fit_value[i]=val+predicted;
+        fit_value[i]=val+predicted&0x7fff;
         fit_value[look->loneighbor[i-2]]&=0x7fff;
         fit_value[look->hineighbor[i-2]]&=0x7fff;
 
       }else{
         fit_value[i]=predicted|0x8000;
       }
 
     }
@@ -1061,23 +1061,28 @@ static int floor1_inverse2(vorbis_block 
   int j;
 
   if(memo){
     /* render the lines */
     int *fit_value=(int *)memo;
     int hx=0;
     int lx=0;
     int ly=fit_value[0]*info->mult;
+    /* guard lookup against out-of-range values */
+    ly=(ly<0?0:ly>255?255:ly);
+
     for(j=1;j<look->posts;j++){
       int current=look->forward_index[j];
       int hy=fit_value[current]&0x7fff;
       if(hy==fit_value[current]){
 
+        hx=info->postlist[current];
         hy*=info->mult;
-        hx=info->postlist[current];
+        /* guard lookup against out-of-range values */
+        hy=(hy<0?0:hy>255?255:hy);
 
         render_line(n,lx,hx,ly,hy,out);
 
         lx=hx;
         ly=hy;
       }
     }
     for(j=hx;j<n;j++)out[j]*=FLOOR1_fromdB_LOOKUP[ly]; /* be certain */
--- a/media/libvorbis/lib/vorbis_info.c
+++ b/media/libvorbis/lib/vorbis_info.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2010             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: maintain the info structure, info <-> header packets
- last mod: $Id: info.c 17080 2010-03-26 06:59:58Z xiphmont $
+ last mod: $Id: info.c 17584 2010-11-01 19:26:16Z xiphmont $
 
  ********************************************************************/
 
 /* general handling of the header and the vorbis_info structure (and
    substructures) */
 
 #include <stdlib.h>
 #include <string.h>
@@ -26,18 +26,18 @@
 #include "codec_internal.h"
 #include "codebook.h"
 #include "registry.h"
 #include "window.h"
 #include "psy.h"
 #include "misc.h"
 #include "os.h"
 
-#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.1"
-#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20100325 (Everywhere)"
+#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.2"
+#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20101101 (Schaufenugget)"
 
 /* helpers */
 static int ilog2(unsigned int v){
   int ret=0;
   if(v)--v;
   while(v){
     ret++;
     v>>=1;
@@ -640,16 +640,25 @@ int vorbis_analysis_headerout(vorbis_dsp
     b->header=NULL;
     b->header1=NULL;
     b->header2=NULL;
   }
   return(ret);
 }
 
 double vorbis_granule_time(vorbis_dsp_state *v,ogg_int64_t granulepos){
-  if(granulepos>=0)
+  if(granulepos == -1) return -1;
+
+  /* We're not guaranteed a 64 bit unsigned type everywhere, so we
+     have to put the unsigned granpo in a signed type. */
+  if(granulepos>=0){
     return((double)granulepos/v->vi->rate);
-  return(-1);
+  }else{
+    ogg_int64_t granuleoff=0xffffffff;
+    granuleoff<<=31;
+    granuleoff|=0x7ffffffff;
+    return(((double)granulepos+2+granuleoff+granuleoff)/v->vi->rate);
+  }
 }
 
 const char *vorbis_version_string(void){
   return GENERAL_VENDOR_STRING;
 }
--- a/media/libvorbis/lib/vorbis_lsp.c
+++ b/media/libvorbis/lib/vorbis_lsp.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
   function: LSP (also called LSF) conversion routines
-  last mod: $Id: lsp.c 16227 2009-07-08 06:58:46Z xiphmont $
+  last mod: $Id: lsp.c 17538 2010-10-15 02:52:29Z tterribe $
 
   The LSP generation code is taken (with minimal modification and a
   few bugfixes) from "On the Computation of the LSP Frequencies" by
   Joseph Rothweiler (see http://www.rothweiler.us for contact info).
   The paper is available at:
 
   http://www.myown1.com/joe/lsf
 
@@ -41,17 +41,17 @@
 #include "lookup.h"
 #include "scales.h"
 
 /* three possible LSP to f curve functions; the exact computation
    (float), a lookup based float implementation, and an integer
    implementation.  The float lookup is likely the optimal choice on
    any machine with an FPU.  The integer implementation is *not* fixed
    point (due to the need for a large dynamic range and thus a
-   seperately tracked exponent) and thus much more complex than the
+   separately tracked exponent) and thus much more complex than the
    relatively simple float implementations. It's mostly for future
    work on a fully fixed point implementation for processors like the
    ARM family. */
 
 /* define either of these (preferably FLOAT_LOOKUP) to have faster
    but less precise implementation. */
 #undef FLOAT_LOOKUP
 #undef INT_LOOKUP
@@ -76,21 +76,21 @@ void vorbis_lsp_to_curve(float *curve,in
     int k=map[i];
     int qexp;
     float p=.7071067812f;
     float q=.7071067812f;
     float w=vorbis_coslook(wdel*k);
     float *ftmp=lsp;
     int c=m>>1;
 
-    do{
+    while(c--){
       q*=ftmp[0]-w;
       p*=ftmp[1]-w;
       ftmp+=2;
-    }while(--c);
+    }
 
     if(m&1){
       /* odd order filter; slightly assymetric */
       /* the last coefficient */
       q*=ftmp[0]-w;
       q*=q;
       p*=p*(1.f-w*w);
     }else{
--- a/media/libvorbis/lib/vorbis_psy.c
+++ b/media/libvorbis/lib/vorbis_psy.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2010             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: psychoacoustics not including preecho
- last mod: $Id: psy.c 17077 2010-03-26 06:22:19Z xiphmont $
+ last mod: $Id: psy.c 17569 2010-10-26 17:09:47Z xiphmont $
 
  ********************************************************************/
 
 #include <stdlib.h>
 #include <math.h>
 #include <string.h>
 #include "vorbis/codec.h"
 #include "codec_internal.h"
@@ -1155,24 +1155,32 @@ void _vp_couple_quantize_normalize(int b
                 qeM[j] = fabs(reM[j]);
               }else{
                 /* AoTuV */
                 /** @ M2 **
                     The boost problem by the combination of noise normalization and point stereo is eased.
                     However, this is a temporary patch.
                     by Aoyumi @ 2004/04/18
                 */
-                float derate = (1.0 - de*((float)(j-limit+i) / (float)(n-limit)));
-
-                /* elliptical */
+                /*float derate = (1.0 - de*((float)(j-limit+i) / (float)(n-limit)));
+                /* elliptical 
                 if(reM[j]+reA[j]<0){
                   reM[j] = - (qeM[j] = (fabs(reM[j])+fabs(reA[j]))*derate*derate);
                 }else{
                   reM[j] =   (qeM[j] = (fabs(reM[j])+fabs(reA[j]))*derate*derate);
+                  }*/
+
+                /* elliptical */
+                if(reM[j]+reA[j]<0){
+                  reM[j] = - (qeM[j] = fabs(reM[j])+fabs(reA[j]));
+                }else{
+                  reM[j] =   (qeM[j] = fabs(reM[j])+fabs(reA[j]));
                 }
+
+
               }
               reA[j]=qeA[j]=0.f;
               fA[j]=1;
               iA[j]=0;
             }
           }
           floorM[j]=floorA[j]=floorM[j]+floorA[j];
         }
--- a/media/libvorbis/lib/vorbis_res0.c
+++ b/media/libvorbis/lib/vorbis_res0.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2010             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: residue backend 0, 1 and 2 implementation
- last mod: $Id: res0.c 16962 2010-03-11 07:30:34Z xiphmont $
+ last mod: $Id: res0.c 17556 2010-10-21 18:25:19Z tterribe $
 
  ********************************************************************/
 
 /* Slow, slow, slow, simpleminded and did I mention it was slow?  The
    encode/decode loops are coded for clarity and performance is not
    yet even a nagging little idea lurking in the shadows.  Oh and BTW,
    it's slow. */
 
@@ -245,16 +245,17 @@ vorbis_info_residue *res0_unpack(vorbis_
   /* modify the phrasebook ranging check from r16327; an early beta
      encoder had a bug where it used an oversized phrasebook by
      accident.  These files should continue to be playable, but don't
      allow an exploit */
   {
     int entries = ci->book_param[info->groupbook]->entries;
     int dim = ci->book_param[info->groupbook]->dim;
     int partvals = 1;
+    if (dim<1) goto errout;
     while(dim>0){
       partvals *= info->partitions;
       if(partvals > entries) goto errout;
       dim--;
     }
     info->partvals = partvals;
   }
 
@@ -823,17 +824,17 @@ int res2_inverse(vorbis_block *vb,vorbis
     if(i==ch)return(0); /* no nonzero vectors */
 
     for(s=0;s<look->stages;s++){
       for(i=0,l=0;i<partvals;l++){
 
         if(s==0){
           /* fetch the partition word */
           int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-          if(temp==-1 || temp>info->partvals)goto eopbreak;
+          if(temp==-1 || temp>=info->partvals)goto eopbreak;
           partword[l]=look->decodemap[temp];
           if(partword[l]==NULL)goto errout;
         }
 
         /* now we decode residual values for the partitions */
         for(k=0;k<partitions_per_word && i<partvals;k++,i++)
           if(info->secondstages[partword[l][k]]&(1<<s)){
             codebook *stagebook=look->partbooks[partword[l][k]][s];
--- a/media/libvorbis/lib/vorbis_synthesis.c
+++ b/media/libvorbis/lib/vorbis_synthesis.c
@@ -6,17 +6,17 @@
  * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING.       *
  *                                                                  *
  * THE OggVorbis SOURCE CODE IS (C) COPYRIGHT 1994-2009             *
  * by the Xiph.Org Foundation http://www.xiph.org/                  *
  *                                                                  *
  ********************************************************************
 
  function: single-block PCM synthesis
- last mod: $Id: synthesis.c 17027 2010-03-25 05:21:20Z xiphmont $
+ last mod: $Id: synthesis.c 17474 2010-09-30 03:41:41Z gmaxwell $
 
  ********************************************************************/
 
 #include <stdio.h>
 #include <ogg/ogg.h>
 #include "vorbis/codec.h"
 #include "codec_internal.h"
 #include "registry.h"
@@ -106,24 +106,23 @@ int vorbis_synthesis_trackonly(vorbis_bl
   /* Check the packet type */
   if(oggpack_read(opb,1)!=0){
     /* Oops.  This is not an audio data packet */
     return(OV_ENOTAUDIO);
   }
 
   /* read our mode and pre/post windowsize */
   mode=oggpack_read(opb,b->modebits);
-  if(mode==-1) {
+  if(mode==-1)return(OV_EBADPACKET);
+
+  vb->mode=mode;
+  if(!ci->mode_param[mode]){
     return(OV_EBADPACKET);
   }
-
-  vb->mode=mode;
-  if(!ci->mode_param[mode]) {
-    return(OV_EBADPACKET); 
-  }
+  
   vb->W=ci->mode_param[mode]->blockflag;
   if(vb->W){
     vb->lW=oggpack_read(opb,1);
     vb->nW=oggpack_read(opb,1);
     if(vb->nW==-1)   return(OV_EBADPACKET);
   }else{
     vb->lW=0;
     vb->nW=0;
--- a/media/libvorbis/update.sh
+++ b/media/libvorbis/update.sh
@@ -42,9 +42,8 @@ cp $1/lib/codebook.c ./lib/vorbis_codebo
 cp $1/lib/bitrate.c ./lib/vorbis_bitrate.c
 cp $1/lib/block.c ./lib/vorbis_block.c
 cp $1/include/vorbis/codec.h ./include/vorbis/codec.h
 cp $1/todo.txt ./todo.txt
 cp $1/COPYING ./COPYING
 cp $1/README ./README
 cp $1/AUTHORS ./AUTHORS
 patch -p3 < ./alloca.diff
-patch -p3 <bug487519.patch