Fix for overflow bug in bitwise routines; read past end triggered too late.

Monty

svn path=/trunk/vorbis/; revision=248

diff --git a/lib/bitwise.c b/lib/bitwise.c
index 2f87a0c5107b8be244b44821e6bb19a7292c7b82..37599b64735e5106ba8bcb555339f18007884cdb 100644 (file)
--- a/lib/bitwise.c
+++ b/lib/bitwise.c
@@ -12,7 +12,7 @@
  ********************************************************************
 
   function: packing variable sized words into an octet stream
-  last mod: $Id: bitwise.c,v 1.6 2000/01/12 11:16:35 xiphmont Exp $
+  last mod: $Id: bitwise.c,v 1.7 2000/02/05 23:23:56 xiphmont Exp $
 
  ********************************************************************/
 
@@ -101,7 +101,7 @@ long _oggpack_look(oggpack_buffer *b,int bits){
 
   if(b->endbyte+4>=b->storage){
     /* not the main path */
-    if(b->endbyte+(bits+b->endbit-1)/8>b->storage)return(-1);
+    if(b->endbyte+(bits-1)/8>=b->storage)return(-1);
   }
   
   ret=b->ptr[0]>>b->endbit;
@@ -149,7 +149,7 @@ long _oggpack_read(oggpack_buffer *b,int bits){
   if(b->endbyte+4>=b->storage){
     /* not the main path */
     ret=-1;
-    if(b->endbyte+(bits+b->endbit-1)/8>b->storage)goto overflow;
+    if(b->endbyte+(bits-1)/8>=b->storage)goto overflow;
   }
   
   ret=b->ptr[0]>>b->endbit;
@@ -363,7 +363,7 @@ int main(void){
 
   fprintf(stderr,"\nSingle bit unclicpped packing: ");
   cliptest(testbuffer3,test3size,1,six,sixsize);
-  fprintf(stderr,"ok.\n");
+  fprintf(stderr,"ok.\n\n");
   return(0);
 }  
 #endif

diff --git a/lib/codebook.c b/lib/codebook.c
index a51cf4fe79bbc7266ee21293a43f4e0cce332b1e..a7a6a53ddd11ad8bcb5b9a6dbd8f3b3e3062f149 100644 (file)
--- a/lib/codebook.c
+++ b/lib/codebook.c
@@ -12,7 +12,7 @@
  ********************************************************************
 
  function: basic codebook pack/unpack/code/decode operations
- last mod: $Id: codebook.c,v 1.4 2000/01/28 09:05:08 xiphmont Exp $
+ last mod: $Id: codebook.c,v 1.5 2000/02/05 23:23:58 xiphmont Exp $
 
  ********************************************************************/
 
@@ -553,7 +553,7 @@ int main(){
     _oggpack_reset(&write);
     vorbis_book_init_encode(&c,testlist[ptr]); /* get it into memory
                                                   we can write */
-    vorbis_book_pack(testlist[ptr],&write);
+    vorbis_staticbook_pack(testlist[ptr],&write);
     fprintf(stderr,"Codebook size %ld bytes... ",_oggpack_bytes(&write));
     for(i=0;i<TESTSIZE;i+=TESTDIM)
       vorbis_book_encodev(&c,qv+i,&write);
@@ -564,7 +564,7 @@ int main(){
 
     /* transfer the write data to a read buffer and unpack/read */
     _oggpack_readinit(&read,_oggpack_buffer(&write),_oggpack_bytes(&write));
-    if(vorbis_book_unpack(&read,&s)){
+    if(vorbis_staticbook_unpack(&read,&s)){
       fprintf(stderr,"Error unpacking codebook.\n");
       exit(1);
     }