diff options
-rw-r--r-- | apps/codecs/libtremor/res012.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/apps/codecs/libtremor/res012.c b/apps/codecs/libtremor/res012.c index bcddf97640..1263fa65ba 100644 --- a/apps/codecs/libtremor/res012.c +++ b/apps/codecs/libtremor/res012.c | |||
@@ -97,16 +97,27 @@ static vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){ | |||
97 | info->partitions=oggpack_read(opb,6)+1; | 97 | info->partitions=oggpack_read(opb,6)+1; |
98 | info->groupbook=oggpack_read(opb,8); | 98 | info->groupbook=oggpack_read(opb,8); |
99 | 99 | ||
100 | /* check for premature EOP */ | ||
101 | if(info->groupbook<0)goto errout; | ||
102 | |||
100 | for(j=0;j<info->partitions;j++){ | 103 | for(j=0;j<info->partitions;j++){ |
101 | int cascade=oggpack_read(opb,3); | 104 | int cascade=oggpack_read(opb,3); |
102 | if(oggpack_read(opb,1)) | 105 | int cflag=oggpack_read(opb,1); |
103 | cascade|=(oggpack_read(opb,5)<<3); | 106 | if(cflag<0) goto errout; |
107 | if(cflag){ | ||
108 | int c=oggpack_read(opb,5); | ||
109 | if(c<0) goto errout; | ||
110 | cascade|=(c<<3); | ||
111 | } | ||
104 | info->secondstages[j]=cascade; | 112 | info->secondstages[j]=cascade; |
105 | 113 | ||
106 | acc+=icount(cascade); | 114 | acc+=icount(cascade); |
107 | } | 115 | } |
108 | for(j=0;j<acc;j++) | 116 | for(j=0;j<acc;j++){ |
109 | info->booklist[j]=oggpack_read(opb,8); | 117 | int book=oggpack_read(opb,8); |
118 | if(book<0) goto errout; | ||
119 | info->booklist[j]=book; | ||
120 | } | ||
110 | 121 | ||
111 | if(info->groupbook>=ci->books)goto errout; | 122 | if(info->groupbook>=ci->books)goto errout; |
112 | for(j=0;j<acc;j++){ | 123 | for(j=0;j<acc;j++){ |