Merge cherrypicks of [16009370, 16012241, 16012242, 16012310, 16012367, 16012311, 16012312, 16012313, 16012216, 16012387, 16012388, 16012390, 16012335, 16012391] into security-aosp-qt-releaseandroid-security-10.0.0_r75android-security-10.0.0_r74android-security-10.0.0_r73android-security-10.0.0_r72android-security-10.0.0_r71android-security-10.0.0_r70android-security-10.0.0_r69android-security-10.0.0_r68android-security-10.0.0_r67android-security-10.0.0_r66android-security-10.0.0_r65android-security-10.0.0_r64android-security-10.0.0_r63android-security-10.0.0_r62android-security-10.0.0_r61android10-security-release

Change-Id: I4c04374556cbbde177537acb1649e77d715175d2

2 files changed, 7 insertions, 3 deletions

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 8948cf3..d62aefa 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -847,6 +847,7 @@ static int decode_map(codebook *s, oggpack_buffer *b, ogg_int32_t *v, int point)
 #endif
 
 /* returns 0 on OK or -1 on eof *************************************/
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
                               oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -864,6 +865,7 @@ long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
   return 0;
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -880,6 +882,9 @@ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
   return 0;
 }
 
+/* unlike the others, we guard against n not being an integer number
+   of <dim> internally rather than in the upper layer (called only by
+   floor0) */
 long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
diff --git a/Tremolo/floor0.c b/Tremolo/floor0.c
index b6ece29..812c720 100644
--- a/Tremolo/floor0.c
+++ b/Tremolo/floor0.c
@@ -419,10 +419,9 @@ ogg_int32_t *floor0_inverse1(vorbis_dsp_state *vd,vorbis_info_floor *i,
       }
       ogg_int32_t last=0;
 
-      for(j=0;j<info->order;j+=b->dim)
-        if(vorbis_book_decodev_set(b,lsp+j,&vd->opb,b->dim,-24)==-1)goto eop;
+      if(vorbis_book_decodev_set(b,lsp,&vd->opb,info->order,-24)==-1)goto eop;
       for(j=0;j<info->order;){
-        for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
+        for(k=0;k<b->dim && j<info->order;k++,j++)lsp[j]+=last;
         last=lsp[j-1];
       }