libvorbis/libvorbis-r14604-CVE-2008-1423.diff

14 lines
478 B
Diff

Index: /trunk/vorbis/lib/codebook.c
================================================================================
--- libvorbis/BUILD/libvorbis-1.2.0/lib/codebook.c
+++ libvorbis/BUILD/libvorbis-1.2.0/lib/codebook.c
@@ -159,6 +159,8 @@
s->entries=oggpack_read(opb,24);
if(s->entries==-1)goto _eofout;
+ if(_ilog(s->dim)+_ilog(s->entries)>24)goto _eofout;
+
/* codeword ordering.... length ordered or unordered? */
switch((int)oggpack_read(opb,1)){
case 0: