diff options
| author | Snehal N Bhamare <snehal.bhamare@ittiam.com> | 2020-06-08 23:35:01 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-07-26 09:00:27 -0700 |
| commit | 162c009de66dcd0a1837a16c71b317f11919625a (patch) | |
| tree | 181ab174ecd0652f26f83222610aec44d3d635db /Tremolo | |
| parent | dbe0e8752bc791f19fd6c47d9a88cc9f584ee32a (diff) | |
| download | tremolo-162c009de66dcd0a1837a16c71b317f11919625a.tar.gz | |
Fix: Add check in floor1_info_unpack
Add check for rangebits set by oggpack_read().
Bug: 155560008
Test: poc in bug
Change-Id: I7bd1ea124eca9670cc56fe1d4fc255a281527105
Diffstat (limited to 'Tremolo')
| -rw-r--r-- | Tremolo/floor1.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c index 7811aba..1a920a7 100644 --- a/Tremolo/floor1.c +++ b/Tremolo/floor1.c @@ -140,6 +140,7 @@ vorbis_info_floor *floor1_info_unpack (vorbis_info *vi,oggpack_buffer *opb){ /* read the post list */ info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */ rangebits=oggpack_read(opb,4); + if(rangebits < 0) goto err_out; for(j=0,k=0;j<info->partitions;j++) count+=info->klass[info->partitionclass[j]].class_dim; |