From: Guido Günther <agx@sigxcpu.org>
Date: Tue, 31 Oct 2017 17:32:46 +0000 (+0100)
Subject: CVE-2017-14633: Don't allow for more than 256 channels
X-Git-Tag: v1.3.6~5
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;ds=sidebyside;h=a79ec216cd119069c68b8f3542c6a425a74ab993;p=platform%2Fupstream%2Flibvorbis.git

CVE-2017-14633: Don't allow for more than 256 channels

Otherwise

 for(i=0;i<vi->channels;i++){
      /* the encoder setup assumes that all the modes used by any
         specific bitrate tweaking use the same floor */
      int submap=info->chmuxlist[i];

overreads later in mapping0_forward since chmuxlist is a fixed array of
256 elements max.
---

diff --git a/lib/info.c b/lib/info.c
index fe759ed..7bc4ea4 100644
--- a/lib/info.c
+++ b/lib/info.c
@@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
   oggpack_buffer opb;
   private_state *b=v->backend_state;
 
-  if(!b||vi->channels<=0){
+  if(!b||vi->channels<=0||vi->channels>256){
     ret=OV_EFAULT;
     goto err_out;
   }