From 49487dfd780bf0e33ca9aec4210f6f1eef8d8ba7 Mon Sep 17 00:00:00 2001 From: Google Chrome <> Date: Tue, 9 Feb 2010 19:46:22 +0000 Subject: Fix book_idx check. 25_vorbis_floor0_index.patch by chrome. backport r19984 by michael Originally committed as revision 21724 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5 --- libavcodec/vorbis_dec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c index 305ceadaa1..29e7bdbf41 100644 --- a/libavcodec/vorbis_dec.c +++ b/libavcodec/vorbis_dec.c @@ -558,12 +558,11 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) { uint_fast8_t book_idx; for (idx=0;idxdata.t0.num_books;++idx) { book_idx=get_bits(gb, 8); + if (book_idx>=vc->codebook_count) + return 1; floor_setup->data.t0.book_list[idx]=book_idx; if (vc->codebooks[book_idx].dimensions > max_codebook_dim) max_codebook_dim=vc->codebooks[book_idx].dimensions; - - if (floor_setup->data.t0.book_list[idx]>vc->codebook_count) - return 1; } } -- cgit v1.2.3