From: Jan Schmidt <thaytan@mad.scientist.com>
Date: Fri, 11 Apr 2008 10:32:20 +0000 (+0000)
Subject: ext/speex/gstspeexdec.c: Fix bounds checking of mode in Speex header, which may produ... 
X-Git-Tag: RELEASE-0_10_8~22
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a578ebb9646a39ed269699d91494653c44c9fcbd;p=platform%2Fupstream%2Fgst-plugins-good.git

ext/speex/gstspeexdec.c: Fix bounds checking of mode in Speex header, which may produce negative numbers in speex < 1...

Original commit message from CVS:
* ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
Fix bounds checking of mode in Speex header, which may
produce negative numbers in speex < 1.1.12
---

diff --git a/ChangeLog b/ChangeLog
index 1feb940..b418e46 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2008-04-11  Jan Schmidt  <Jan.Schmidt@sun.com>
+
+	* ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
+	Fix bounds checking of mode in Speex header, which may
+	produce negative numbers in speex < 1.1.12
+
 2008-04-09  Tim-Philipp Müller  <tim at centricular dot net>
 
 	* gst/goom/Makefile.am:
diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c
index fbd7125..48d1605 100644
--- a/ext/speex/gstspeexdec.c
+++ b/ext/speex/gstspeexdec.c
@@ -507,7 +507,7 @@ speex_dec_chain_parse_header (GstSpeexDec * dec, GstBuffer * buf)
   if (!dec->header)
     goto no_header;
 
-  if (dec->header->mode >= SPEEX_NB_MODES)
+  if (dec->header->mode >= SPEEX_NB_MODES || dec->header->mode < 0)
     goto mode_too_old;
 
   dec->mode = (SpeexMode *) speex_mode_list[dec->header->mode];