[FFmpeg-cvslog] r20411 - trunk/libavcodec/vorbis_dec.c

[Reimar Döffinger]

On Fri, Jul 02, 2010 at 12:38:14AM +0100, M?ns Rullg?rd wrote:
> reimar <subversion at mplayerhq.hu> writes:
> 
> > @@ -564,10 +571,7 @@ static int vorbis_parse_setup_hdr_floors
> >                  int idx;
> >                  uint_fast8_t book_idx;
> >                  for (idx = 0; idx < floor_setup->data.t0.num_books; ++idx) {
> > -                    book_idx = get_bits(gb, 8);
> > -                    if (book_idx >= vc->codebook_count)
> > -                        return -1;
> > -                    floor_setup->data.t0.book_list[idx] = book_idx;
> > +                    GET_VALIDATED_INDEX(floor_setup->data.t0.book_list[idx], 8, vc->codebook_count)
> >                      if (vc->codebooks[book_idx].dimensions > max_codebook_dim)
> >                          max_codebook_dim = vc->codebooks[book_idx].dimensions;
> >                  }
> 
> This looks wrong.  book_idx is never written.

I guess this should fix it?
Index: vorbis_dec.c
===================================================================
--- vorbis_dec.c        (revision 23825)
+++ vorbis_dec.c        (working copy)
@@ -569,7 +569,8 @@
                 int idx;
                 uint_fast8_t book_idx;
                 for (idx = 0; idx < floor_setup->data.t0.num_books; ++idx) {
-                    GET_VALIDATED_INDEX(floor_setup->data.t0.book_list[idx], 8, vc->codebook_count)
+                    GET_VALIDATED_INDEX(book_idx, 8, vc->codebook_count)
+                    floor_setup->data.t0.book_list[idx] = book_idx;
                     if (vc->codebooks[book_idx].dimensions > max_codebook_dim)
                         max_codebook_dim = vc->codebooks[book_idx].dimensions;
                 }