ext/speex/gstspeexdec.c: Fix bounds checking of mode in Speex header, which may produ...

Original commit message from CVS:
* ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
Fix bounds checking of mode in Speex header, which may
produce negative numbers in speex < 1.1.12

diff --git a/ChangeLog b/ChangeLog
index 1feb940..b418e46 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2008-04-11  Jan Schmidt  <Jan.Schmidt@sun.com>
+
+       * ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
+       Fix bounds checking of mode in Speex header, which may
+       produce negative numbers in speex < 1.1.12
+
 2008-04-09  Tim-Philipp Müller  <tim at centricular dot net>
 
        * gst/goom/Makefile.am:

diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c
index fbd7125..48d1605 100644 (file)
--- a/ext/speex/gstspeexdec.c
+++ b/ext/speex/gstspeexdec.c
@@ -507,7 +507,7 @@ speex_dec_chain_parse_header (GstSpeexDec * dec, GstBuffer * buf)
   if (!dec->header)
     goto no_header;
 
-  if (dec->header->mode >= SPEEX_NB_MODES)
+  if (dec->header->mode >= SPEEX_NB_MODES || dec->header->mode < 0)
     goto mode_too_old;
 
   dec->mode = (SpeexMode *) speex_mode_list[dec->header->mode];