1 files changed, 8 insertions, 3 deletions

diff --git a/apps/codecs/libtremor/floor1.c b/apps/codecs/libtremor/floor1.c
index ae92b23058..65286399d0 100644
--- a/apps/codecs/libtremor/floor1.c
+++ b/apps/codecs/libtremor/floor1.c
@@ -361,7 +361,7 @@ static void *floor1_inverse1(vorbis_block *vb,vorbis_look_floor *in){
           }
         }
 
-        fit_value[i]=val+predicted;
+        fit_value[i]=(val+predicted)&0x7fff;;
         fit_value[look->loneighbor[i-2]]&=0x7fff;
         fit_value[look->hineighbor[i-2]]&=0x7fff;
 
@@ -393,14 +393,19 @@ static int floor1_inverse2(vorbis_block *vb,vorbis_look_floor *in,void *memo,
     int hx=0;
     int lx=0;
     int ly=fit_value[0]*info->mult;
+    /* guard lookup against out-of-range values */
+    ly=(ly<0?0:ly>255?255:ly);
+
     for(j=1;j<look->posts;j++){
       int current=look->forward_index[j];
       int hy=fit_value[current]&0x7fff;
       if(hy==fit_value[current]){
         
+        hx=info->postlist[current];
         hy*=info->mult;
-        hx=info->postlist[current];
-        
+        /* guard lookup against out-of-range values */
+        hy=(hy<0?0:hy>255?255:hy);
+
         render_line(lx, ly, hx, hy, out);
         
         lx=hx;