Bug 1446062: libtremor Vorbis fix. r=jmspeex a=dveditz FENNEC_60_0b4_BUILD2 FENNEC_60_0b4_RELEASE
authorThomas Daede <daede003@umn.edu>
Thu, 15 Mar 2018 21:47:09 -0700
changeset 460151 0ae512558ada8254d73fc982c581ffe481c11b20
parent 460150 4d345541a6ff242408a35023f4fffc94b101b35c
child 460152 2e79c6c38bf56e29692b4f021ec4a125fc30389c
push id8854
push userdbaron@mozilla.com
push dateFri, 16 Mar 2018 06:13:44 +0000
treeherdermozilla-beta@0ae512558ada [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjmspeex, dveditz
bugs1446062
milestone60.0
Bug 1446062: libtremor Vorbis fix. r=jmspeex a=dveditz
media/libtremor/lib/tremor_codebook.c
--- a/media/libtremor/lib/tremor_codebook.c
+++ b/media/libtremor/lib/tremor_codebook.c
@@ -253,26 +253,26 @@ long vorbis_book_decodevs_add(codebook *
     
     if(shift>=0){
       for (i = 0; i < step; i++) {
 	entry[i]=decode_packed_entry_number(book,b);
 	if(entry[i]==-1)return(-1);
 	t[i] = book->valuelist+entry[i]*book->dim;
       }
       for(i=0,o=0;i<book->dim;i++,o+=step)
-	for (j=0;j<step;j++)
+	for (j=0;o+j<n && j<step;j++)
 	  a[o+j]+=t[j][i]>>shift;
     }else{
       for (i = 0; i < step; i++) {
 	entry[i]=decode_packed_entry_number(book,b);
 	if(entry[i]==-1)return(-1);
 	t[i] = book->valuelist+entry[i]*book->dim;
       }
       for(i=0,o=0;i<book->dim;i++,o+=step)
-	for (j=0;j<step;j++)
+	for (j=0;o+j<n && j<step;j++)
 	  a[o+j]+=t[j][i]<<-shift;
     }
   }
   return(0);
 }
 
 /* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
@@ -282,25 +282,25 @@ long vorbis_book_decodev_add(codebook *b
     ogg_int32_t *t;
     int shift=point-book->binarypoint;
     
     if(shift>=0){
       for(i=0;i<n;){
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	t     = book->valuelist+entry*book->dim;
-	for (j=0;j<book->dim;)
+	for (j=0;i<n && j<book->dim;)
 	  a[i++]+=t[j++]>>shift;
       }
     }else{
       for(i=0;i<n;){
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	t     = book->valuelist+entry*book->dim;
-	for (j=0;j<book->dim;)
+	for (j=0;i<n && j<book->dim;)
 	  a[i++]+=t[j++]<<-shift;
       }
     }
   }
   return(0);
 }
 
 /* unlike the others, we guard against n not being an integer number
@@ -347,41 +347,41 @@ long vorbis_book_decodev_set(codebook *b
 /* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevv_add(codebook *book,ogg_int32_t **a,\
 			      long offset,int ch,
 			      oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
     long i,j,entry;
     int chptr=0;
     int shift=point-book->binarypoint;
-    
+    int m=offset+n;
     if(shift>=0){
       
-      for(i=offset;i<offset+n;){
+      for(i=offset;i<m;){
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	{
 	  const ogg_int32_t *t = book->valuelist+entry*book->dim;
-	  for (j=0;j<book->dim;j++){
+	  for (j=0;i<m && j<book->dim;j++){
 	    a[chptr++][i]+=t[j]>>shift;
 	    if(chptr==ch){
 	      chptr=0;
 	      i++;
 	    }
 	  }
 	}
       }
     }else{
       
-      for(i=offset;i<offset+n;){
+      for(i=offset;i<m;){
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	{
 	  const ogg_int32_t *t = book->valuelist+entry*book->dim;
-	  for (j=0;j<book->dim;j++){
+	  for (j=0;i<m && j<book->dim;j++){
 	    a[chptr++][i]+=t[j]<<-shift;
 	    if(chptr==ch){
 	      chptr=0;
 	      i++;
 	    }
 	  }
 	}
       }