From: Google Chrome <>
Date: Wed, 23 Sep 2009 12:17:54 +0000 (+0000)
Subject: Check masterbook index and subclass book index.
X-Git-Tag: v0.6~3197
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=993092dcd3fb7ec84fdd1cd3b28a3973740b22bf;p=platform%2Fupstream%2Flibav.git

Check masterbook index and subclass book index.
14_floor_masterbook_index.patch by chrome

Originally committed as revision 19991 to svn://svn.ffmpeg.org/ffmpeg/trunk
---

diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c
index ec305ba..3daba8f 100644
--- a/libavcodec/vorbis_dec.c
+++ b/libavcodec/vorbis_dec.c
@@ -487,13 +487,23 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) {
                 AV_DEBUG(" %d floor %d class dim: %d subclasses %d \n", i, j, floor_setup->data.t1.class_dimensions[j], floor_setup->data.t1.class_subclasses[j]);
 
                 if (floor_setup->data.t1.class_subclasses[j]) {
-                    floor_setup->data.t1.class_masterbook[j]=get_bits(gb, 8);
+                    int bits=get_bits(gb, 8);
+                    if (bits>=vc->codebook_count) {
+                        av_log(vc->avccontext, AV_LOG_ERROR, "Masterbook index %d is out of range.\n", bits);
+                        return 1;
+                    }
+                    floor_setup->data.t1.class_masterbook[j]=bits;
 
                     AV_DEBUG("   masterbook: %d \n", floor_setup->data.t1.class_masterbook[j]);
                 }
 
                 for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) {
-                    floor_setup->data.t1.subclass_books[j][k]=(int16_t)get_bits(gb, 8)-1;
+                    int16_t bits=get_bits(gb, 8)-1;
+                    if (bits!=-1 && bits>=vc->codebook_count) {
+                        av_log(vc->avccontext, AV_LOG_ERROR, "Subclass book index %d is out of range.\n", bits);
+                        return 1;
+                    }
+                    floor_setup->data.t1.subclass_books[j][k]=bits;
 
                     AV_DEBUG("    book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]);
                 }