Merge commit '0025f7408a0fab2cab4a950064e4784a67463994'

* commit '0025f7408a0fab2cab4a950064e4784a67463994':
  vorbis: Check the vlc value in setup_classifs

Conflicts:
	libavcodec/vorbisdec.c

See: ae038c0914460646503be083e30e3971093239a1
See: 709cae2bcbc0ea2c5d46c932b3d8301cf8f98e6b
Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 15 insertions, 20 deletions

diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 0c74d462be..19bde18a6b 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1329,7 +1329,7 @@ static av_always_inline int setup_classifs(vorbis_context *vc,
     int p, j, i;
     unsigned c_p_c         = codebook->dimensions;
     unsigned inverse_class = ff_inverse[vr->classifications];
-    unsigned temp, temp2;
+    int temp, temp2;
     for (p = 0, j = 0; j < ch_used; ++j) {
         if (!do_not_decode[j]) {
             temp = get_vlc2(&vc->gb, codebook->vlc.table,
@@ -1337,27 +1337,22 @@ static av_always_inline int setup_classifs(vorbis_context *vc,
 
             av_dlog(NULL, "Classword: %u\n", temp);
 
-            if ((int)temp < 0)
-                return temp;
+            av_assert0(temp < 65536);
 
-            av_assert0(vr->classifications > 1); //needed for inverse[]
+            if (temp < 0) {
+                av_log(vc->avctx, AV_LOG_ERROR,
+                       "Invalid vlc code decoding %d channel.", j);
+                return AVERROR_INVALIDDATA;
+            }
 
-            if (temp <= 65536) {
-                for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
-                    temp2 = (((uint64_t)temp) * inverse_class) >> 32;
+            av_assert0(vr->classifications > 1); //needed for inverse[]
 
-                    if (i < ptns_to_read)
-                        vr->classifs[p + i] = temp - temp2 * vr->classifications;
-                    temp = temp2;
-                }
-            } else {
-                for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
-                    temp2 = temp / vr->classifications;
+            for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
+                temp2 = (((uint64_t)temp) * inverse_class) >> 32;
 
-                    if (i < ptns_to_read)
-                        vr->classifs[p + i] = temp - temp2 * vr->classifications;
-                    temp = temp2;
-                }
+                if (i < ptns_to_read)
+                    vr->classifs[p + i] = temp - temp2 * vr->classifications;
+                temp = temp2;
             }
         }
         p += ptns_to_read;
@@ -1413,8 +1408,8 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
         voffset = vr->begin;
         for (partition_count = 0; partition_count < ptns_to_read;) {  // SPEC        error
             if (!pass) {
-                int ret;
-                if ((ret = setup_classifs(vc, vr, do_not_decode, ch_used, partition_count, ptns_to_read)) < 0)
+                int ret = setup_classifs(vc, vr, do_not_decode, ch_used, partition_count, ptns_to_read);
+                if (ret < 0)
                     return ret;
             }
             for (i = 0; (i < c_p_c) && (partition_count < ptns_to_read); ++i) {