Dominique Leuenberger
21dc7c278c
- VUL-0: CVE-2012-0444: libvorbis: heap-based buffer overflow (bnc#747912) OBS-URL: https://build.opensuse.org/request/show/106324 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libvorbis?expand=0&rev=37
15 lines
415 B
Diff
15 lines
415 B
Diff
---
|
|
lib/floor1.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
--- a/lib/floor1.c
|
|
+++ b/lib/floor1.c
|
|
@@ -167,6 +167,7 @@ static vorbis_info_floor *floor1_unpack
|
|
|
|
for(j=0,k=0;j<info->partitions;j++){
|
|
count+=info->class_dim[info->partitionclass[j]];
|
|
+ if(count>VIF_POSIT) goto err_out;
|
|
for(;k<count;k++){
|
|
int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
|
|
if(t<0 || t>=(1<<rangebits))
|