libvorbis/libvorbis-r14598-r14600-CVE-2008-1420.diff

31 lines
970 B
Diff

Index: /trunk/vorbis/lib/res0.c
===================================================================
--- /trunk/vorbis/lib/res0.c (revision 13578)
+++ /trunk/vorbis/lib/res0.c (revision 14598)
@@ -224,4 +224,18 @@
if(info->booklist[j]>=ci->books)goto errout;
+ /* verify the phrasebook is not specifying an impossible or
+ inconsistent partitioning scheme. */
+ {
+ int entries = ci->book_param[info->groupbook]->entries;
+ int dim = ci->book_param[info->groupbook]->dim;
+ int partvals = 1;
+ while(dim>0){
+ partvals *= info->partitions;
+ if(partvals > entries) goto errout;
+ dim--;
+ }
+ if(partvals != entries) goto errout;
+ }
+
return(info);
errout:
@@ -264,5 +278,5 @@
}
- look->partvals=rint(pow((float)look->parts,(float)dim));
+ look->partvals=look->phrasebook->entries;
look->stages=maxstage;
look->decodemap=_ogg_malloc(look->partvals*sizeof(*look->decodemap));