Bug 719612 - Update libvorbis. r=kinetik a=akeybl
authorTimothy B. Terriberry <tterribe@vt.edu>
Fri, 20 Jan 2012 22:54:44 +1300
changeset 81621 1bbf2c5b0af8bc9d5146826a9aa06bb9a6c1cd55
parent 81620 9ba868a26c6c2f2d9fce5860997281723e9ac28a
child 81622 3a99d7ff459cdaa2639f2daf5b5cc2748c0c0eb6
push idunknown
push userunknown
push dateunknown
reviewerskinetik, akeybl
bugs719612
milestone10.0
Bug 719612 - Update libvorbis. r=kinetik a=akeybl
media/libtremor/bug719612.patch
media/libtremor/lib/tremor_floor1.c
media/libtremor/update.sh
media/libvorbis/bug719612.patch
media/libvorbis/lib/vorbis_floor1.c
media/libvorbis/update.sh
new file mode 100644
--- /dev/null
+++ b/media/libtremor/bug719612.patch
@@ -0,0 +1,21 @@
+diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c
+--- a/media/libtremor/lib/tremor_floor1.c
++++ b/media/libtremor/lib/tremor_floor1.c
+@@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack 
+ 
+   /* read the post list */
+   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */ 
+   rangebits=oggpack_read(opb,4);
+   if(rangebits<0)goto err_out;
+ 
+   for(j=0,k=0;j<info->partitions;j++){
+     count+=info->class_dim[info->partitionclass[j]]; 
++    if(count>VIF_POSIT)goto err_out;
+     for(;k<count;k++){
+       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
+       if(t<0 || t>=(1<<rangebits))
+ 	goto err_out;
+     }
+   }
+   info->postlist[0]=0;
+   info->postlist[1]=1<<rangebits;
--- a/media/libtremor/lib/tremor_floor1.c
+++ b/media/libtremor/lib/tremor_floor1.c
@@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack 
 
   /* read the post list */
   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */ 
   rangebits=oggpack_read(opb,4);
   if(rangebits<0)goto err_out;
 
   for(j=0,k=0;j<info->partitions;j++){
     count+=info->class_dim[info->partitionclass[j]]; 
+    if(count>VIF_POSIT)goto err_out;
     for(;k<count;k++){
       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
       if(t<0 || t>=(1<<rangebits))
 	goto err_out;
     }
   }
   info->postlist[0]=0;
   info->postlist[1]=1<<rangebits;
--- a/media/libtremor/update.sh
+++ b/media/libtremor/update.sh
@@ -25,8 +25,9 @@ cp $1/sharedbook.c ./lib/tremor_sharedbo
 cp $1/synthesis.c ./lib/tremor_synthesis.c
 cp $1/window_lookup.h ./lib/window_lookup.h
 cp $1/window.c ./lib/tremor_window.c
 cp $1/window.h ./lib/window.h
 cp $1/ivorbiscodec.h ./include/tremor/ivorbiscodec.h
 cp $1/os.h ./lib/os.h
 cp $1/COPYING ./COPYING
 cp $1/README ./README
+patch -p3 < ./bug719612.patch
new file mode 100644
--- /dev/null
+++ b/media/libvorbis/bug719612.patch
@@ -0,0 +1,21 @@
+diff --git a/media/libvorbis/lib/vorbis_floor1.c b/media/libvorbis/lib/vorbis_floor1.c
+--- a/media/libvorbis/lib/vorbis_floor1.c
++++ b/media/libvorbis/lib/vorbis_floor1.c
+@@ -162,16 +162,17 @@ static vorbis_info_floor *floor1_unpack 
+ 
+   /* read the post list */
+   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */
+   rangebits=oggpack_read(opb,4);
+   if(rangebits<0)goto err_out;
+ 
+   for(j=0,k=0;j<info->partitions;j++){
+     count+=info->class_dim[info->partitionclass[j]];
++    if(count>VIF_POSIT) goto err_out;
+     for(;k<count;k++){
+       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
+       if(t<0 || t>=(1<<rangebits))
+         goto err_out;
+     }
+   }
+   info->postlist[0]=0;
+   info->postlist[1]=1<<rangebits;
--- a/media/libvorbis/lib/vorbis_floor1.c
+++ b/media/libvorbis/lib/vorbis_floor1.c
@@ -162,16 +162,17 @@ static vorbis_info_floor *floor1_unpack 
 
   /* read the post list */
   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */
   rangebits=oggpack_read(opb,4);
   if(rangebits<0)goto err_out;
 
   for(j=0,k=0;j<info->partitions;j++){
     count+=info->class_dim[info->partitionclass[j]];
+    if(count>VIF_POSIT) goto err_out;
     for(;k<count;k++){
       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
       if(t<0 || t>=(1<<rangebits))
         goto err_out;
     }
   }
   info->postlist[0]=0;
   info->postlist[1]=1<<rangebits;
--- a/media/libvorbis/update.sh
+++ b/media/libvorbis/update.sh
@@ -42,8 +42,9 @@ cp $1/lib/codebook.c ./lib/vorbis_codebo
 cp $1/lib/bitrate.c ./lib/vorbis_bitrate.c
 cp $1/lib/block.c ./lib/vorbis_block.c
 cp $1/include/vorbis/codec.h ./include/vorbis/codec.h
 cp $1/todo.txt ./todo.txt
 cp $1/COPYING ./COPYING
 cp $1/README ./README
 cp $1/AUTHORS ./AUTHORS
 patch -p3 < ./alloca.diff
+patch -p3 < ./bug719612.patch