diff options
author | Nils Wallménius <nils@rockbox.org> | 2010-12-06 16:48:57 +0000 |
---|---|---|
committer | Nils Wallménius <nils@rockbox.org> | 2010-12-06 16:48:57 +0000 |
commit | bdf8a243fa0d2d33475ab8b7fd61d791dfcea94f (patch) | |
tree | 4ae98ed4bcfc4fcdc2014b76846b68367639e6b3 /apps/codecs/libtremor/res012.c | |
parent | 0d43bf6a88f6634ed7a132d5ac227a007649f57b (diff) | |
download | rockbox-bdf8a243fa0d2d33475ab8b7fd61d791dfcea94f.tar.gz rockbox-bdf8a243fa0d2d33475ab8b7fd61d791dfcea94f.zip |
libtremor: merge upstream revision 17513 'Add code to prevent heap attacks by exploiting dim==bignum and partition_codewords==partion_values^dim.'
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@28747 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/codecs/libtremor/res012.c')
-rw-r--r-- | apps/codecs/libtremor/res012.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/apps/codecs/libtremor/res012.c b/apps/codecs/libtremor/res012.c index a42660a065..9abe75aed2 100644 --- a/apps/codecs/libtremor/res012.c +++ b/apps/codecs/libtremor/res012.c | |||
@@ -112,6 +112,20 @@ static vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){ | |||
112 | for(j=0;j<acc;j++) | 112 | for(j=0;j<acc;j++) |
113 | if(info->booklist[j]>=ci->books)goto errout; | 113 | if(info->booklist[j]>=ci->books)goto errout; |
114 | 114 | ||
115 | /* verify the phrasebook is not specifying an impossible or | ||
116 | inconsistent partitioning scheme. */ | ||
117 | { | ||
118 | int entries = ci->book_param[info->groupbook]->entries; | ||
119 | int dim = ci->book_param[info->groupbook]->dim; | ||
120 | int partvals = 1; | ||
121 | while(dim>0){ | ||
122 | partvals *= info->partitions; | ||
123 | if(partvals > entries) goto errout; | ||
124 | dim--; | ||
125 | } | ||
126 | if(partvals != entries) goto errout; | ||
127 | } | ||
128 | |||
115 | return(info); | 129 | return(info); |
116 | errout: | 130 | errout: |
117 | res0_free_info(info); | 131 | res0_free_info(info); |