libtremor: merge upstream revisions 17541, 17542, 17543, 17544, 17545, 17546, 17547, 17555, 17572, bringing in various fixes and finally bringing our libtremor up to date, for now.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@28773 a1c6a512-1295-4272-9138-f99709370657

5 files changed, 25 insertions, 15 deletions

diff --git a/apps/codecs/libtremor/codebook.c b/apps/codecs/libtremor/codebook.c
index e00d648a59..9413257e2a 100644
--- a/apps/codecs/libtremor/codebook.c
+++ b/apps/codecs/libtremor/codebook.c
@@ -380,6 +380,7 @@ long vorbis_book_decode(codebook *book, oggpack_buffer *b){
 }
 
 /* returns 0 on OK or -1 on eof *************************************/
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
                               oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){  
@@ -412,6 +413,7 @@ long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
   return(0);
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -441,6 +443,9 @@ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
   return(0);
 }
 
+/* unlike the others, we guard against n not being an integer number
+   of <dim> internally rather than in the upper layer (called only by
+   floor0) */
 long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -454,7 +459,7 @@ long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
         entry = decode_packed_entry_number(book,b);
         if(entry==-1)return(-1);
         t     = book->valuelist+entry*book->dim;
-        for (j=0;j<book->dim;){
+        for (j=0;i<n && j<book->dim;){
           a[i++]=t[j++]>>shift;
         }
       }
@@ -464,23 +469,22 @@ long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
         entry = decode_packed_entry_number(book,b);
         if(entry==-1)return(-1);
         t     = book->valuelist+entry*book->dim;
-        for (j=0;j<book->dim;){
+        for (j=0;i<n && j<book->dim;){
           a[i++]=t[j++]<<shift;
         }
       }
     }
   }else{
 
-    int i,j;
+    int i;
     for(i=0;i<n;){
-      for (j=0;j<book->dim;){
-        a[i++]=0;
-      }
+      a[i++]=0;
     }
   }
   return(0);
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 static long vorbis_book_decodevv_add_2ch_even(codebook *book,ogg_int32_t **a,
                                               long offset,oggpack_buffer *b,
                                               unsigned int n,int point){
diff --git a/apps/codecs/libtremor/floor0.c b/apps/codecs/libtremor/floor0.c
index 075bc36ef7..cd0a9f89f6 100644
--- a/apps/codecs/libtremor/floor0.c
+++ b/apps/codecs/libtremor/floor0.c
@@ -330,6 +330,8 @@ static vorbis_info_floor *floor0_unpack (vorbis_info *vi,oggpack_buffer *opb){
   for(j=0;j<info->numbooks;j++){
     info->books[j]=oggpack_read(opb,8);
     if(info->books[j]<0 || info->books[j]>=ci->books)goto err_out;
+    if(ci->book_param[info->books[j]]->maptype==0)goto err_out;
+    if(ci->book_param[info->books[j]]->dim<1)goto err_out;
   }
   return(info);
 
@@ -400,10 +402,9 @@ static void *floor0_inverse1(vorbis_block *vb,vorbis_look_floor *i){
       ogg_int32_t last=0;
       ogg_int32_t *lsp=(ogg_int32_t *)_vorbis_block_alloc(vb,sizeof(*lsp)*(look->m+1));
             
-      for(j=0;j<look->m;j+=b->dim)
-        if(vorbis_book_decodev_set(b,lsp+j,&vb->opb,b->dim,-24)==-1)goto eop;
+      if(vorbis_book_decodev_set(b,lsp,&vb->opb,look->m,-24)==-1)goto eop;
       for(j=0;j<look->m;){
-        for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
+        for(k=0;j<look->m && k<b->dim;k++,j++)lsp[j]+=last;
         last=lsp[j-1];
       }
       
diff --git a/apps/codecs/libtremor/floor1.c b/apps/codecs/libtremor/floor1.c
index ae92b23058..65286399d0 100644
--- a/apps/codecs/libtremor/floor1.c
+++ b/apps/codecs/libtremor/floor1.c
@@ -361,7 +361,7 @@ static void *floor1_inverse1(vorbis_block *vb,vorbis_look_floor *in){
           }
         }
 
-        fit_value[i]=val+predicted;
+        fit_value[i]=(val+predicted)&0x7fff;;
         fit_value[look->loneighbor[i-2]]&=0x7fff;
         fit_value[look->hineighbor[i-2]]&=0x7fff;
 
@@ -393,14 +393,19 @@ static int floor1_inverse2(vorbis_block *vb,vorbis_look_floor *in,void *memo,
     int hx=0;
     int lx=0;
     int ly=fit_value[0]*info->mult;
+    /* guard lookup against out-of-range values */
+    ly=(ly<0?0:ly>255?255:ly);
+
     for(j=1;j<look->posts;j++){
       int current=look->forward_index[j];
       int hy=fit_value[current]&0x7fff;
       if(hy==fit_value[current]){
         
+        hx=info->postlist[current];
         hy*=info->mult;
-        hx=info->postlist[current];
-        
+        /* guard lookup against out-of-range values */
+        hy=(hy<0?0:hy>255?255:hy);
+
         render_line(lx, ly, hx, hy, out);
         
         lx=hx;
diff --git a/apps/codecs/libtremor/res012.c b/apps/codecs/libtremor/res012.c
index 1263fa65ba..79e3c23e15 100644
--- a/apps/codecs/libtremor/res012.c
+++ b/apps/codecs/libtremor/res012.c
@@ -135,6 +135,7 @@ static vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
     int entries = ci->book_param[info->groupbook]->entries;
     int dim = ci->book_param[info->groupbook]->dim;
     int partvals = 1;
+    if (dim<1) goto errout;
     while(dim>0){
       partvals *= info->partitions;
       if(partvals > entries) goto errout;
@@ -322,7 +323,7 @@ int res2_inverse(vorbis_block *vb,vorbis_look_residue *vl,
         if(s==0){
           /* fetch the partition word */
           int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-          if(temp==-1 || temp>info->partvals)goto eopbreak;
+          if(temp==-1 || temp>=info->partvals)goto eopbreak;
           partword[l]=look->decodemap[temp];
           if(partword[l]==NULL)goto errout;
         }
diff --git a/apps/codecs/libtremor/vorbisfile.c b/apps/codecs/libtremor/vorbisfile.c
index f0a83364ec..5721178b67 100644
--- a/apps/codecs/libtremor/vorbisfile.c
+++ b/apps/codecs/libtremor/vorbisfile.c
@@ -902,7 +902,7 @@ static int _ov_open1(void *f,OggVorbis_File *vf,const char *initial,
        for second stage of seekable stream open; this saves having to
        seek/reread first link's serialnumber data then. */
     vf->serialnos=_ogg_calloc(serialno_list_size+2,sizeof(*vf->serialnos));
-    vf->serialnos[0]=vf->current_serialno;
+    vf->serialnos[0]=vf->current_serialno=vf->os.serialno;
     vf->serialnos[1]=serialno_list_size;
     memcpy(vf->serialnos+2,serialno_list,serialno_list_size*sizeof(*vf->serialnos));
 
@@ -910,7 +910,6 @@ static int _ov_open1(void *f,OggVorbis_File *vf,const char *initial,
     vf->dataoffsets=_ogg_calloc(1,sizeof(*vf->dataoffsets));
     vf->offsets[0]=0;
     vf->dataoffsets[0]=vf->offset;
-    vf->current_serialno=vf->os.serialno;
 
     vf->ready_state=PARTOPEN;
   }