[FFmpeg-cvslog] r21728 - in branches/0.5: . libavcodec/vorbis_dec.c

[siretart]

Author: siretart
Date: Tue Feb  9 20:52:27 2010
New Revision: 21728

Log:
Check  res_setup->books.
15_more_residue_book_indexes.patch by chrome.

r19992 by michael

Modified:
   branches/0.5/   (props changed)
   branches/0.5/libavcodec/vorbis_dec.c

Modified: branches/0.5/libavcodec/vorbis_dec.c
==============================================================================
--- branches/0.5/libavcodec/vorbis_dec.c	Tue Feb  9 20:50:47 2010	(r21727)
+++ branches/0.5/libavcodec/vorbis_dec.c	Tue Feb  9 20:52:27 2010	(r21728)
@@ -668,7 +668,12 @@ static int vorbis_parse_setup_hdr_residu
         for(j=0;j<res_setup->classifications;++j) {
             for(k=0;k<8;++k) {
                 if (cascade[j]&(1<<k)) {
-                        res_setup->books[j][k]=get_bits(gb, 8);
+                    int bits=get_bits(gb, 8);
+                    if (bits>=vc->codebook_count) {
+                        av_log(vc->avccontext, AV_LOG_ERROR, "book value %d out of range. \n", bits);
+                        return 1;
+                    }
+                    res_setup->books[j][k]=bits;
 
                     AV_DEBUG("     %d class casscade depth %d book: %d \n", j, k, res_setup->books[j][k]);