Skip to main content

Browse the archive

Revision 5fec50492f5ff2a41f2b765bd1885ba4450061cb authored by ffxbld on 25 August 2014, 12:18:40 UTC, committed by ffxbld on 25 August 2014, 12:18:40 UTC 
Added FIREFOX_24_8_0esr_RELEASE FIREFOX_24_8_0esr_BUILD1 tag(s) for changeset 420be099bad9. DONTBUILD CLOSED TREE a=release
 
--HG--
branch : GECKO2480esr_2014082508_RELBRANCH
1 parent 183911a
Raw File
bug719612.patch 
diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c
--- a/media/libtremor/lib/tremor_floor1.c
+++ b/media/libtremor/lib/tremor_floor1.c
@@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack 
 
   /* read the post list */
   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */ 
   rangebits=oggpack_read(opb,4);
   if(rangebits<0)goto err_out;
 
   for(j=0,k=0;j<info->partitions;j++){
     count+=info->class_dim[info->partitionclass[j]]; 
+    if(count>VIF_POSIT)goto err_out;
     for(;k<count;k++){
       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
       if(t<0 || t>=(1<<rangebits))
 	goto err_out;
     }
   }
   info->postlist[0]=0;
   info->postlist[1]=1<<rangebits;
back to top