From 55fddec43e7fbd4aed1680e7ae7013f4095fd92b Mon Sep 17 00:00:00 2001
From: Tim Terriberry <tterribe@xiph.org>
Date: Thu, 21 Oct 2010 18:14:51 +0000
Subject: [PATCH] Port r17543 from Tremor.

A codebook that allows values outside the circular range of the piecewise
 floor1 representation can overflow the lookup
Also fix a typo in the comments of the original patch.

svn path=/trunk/vorbis/; revision=17555
---
 lib/floor1.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/floor1.c b/lib/floor1.c
index d5357b7..e1dc2c7 100644
--- a/lib/floor1.c
+++ b/lib/floor1.c
@@ -1035,7 +1035,7 @@ static void *floor1_inverse1(vorbis_block *vb,vorbis_look_floor *in){
           }
         }
 
-        fit_value[i]=val+predicted;
+        fit_value[i]=val+predicted&0x7fff;
         fit_value[look->loneighbor[i-2]]&=0x7fff;
         fit_value[look->hineighbor[i-2]]&=0x7fff;
 
@@ -1066,13 +1066,18 @@ static int floor1_inverse2(vorbis_block *vb,vorbis_look_floor *in,void *memo,
     int hx=0;
     int lx=0;
     int ly=fit_value[0]*info->mult;
+    /* guard lookup against out-of-range values */
+    ly=(ly<0?0:ly>255?255:ly);
+
     for(j=1;j<look->posts;j++){
       int current=look->forward_index[j];
       int hy=fit_value[current]&0x7fff;
       if(hy==fit_value[current]){
 
-        hy*=info->mult;
         hx=info->postlist[current];
+        hy*=info->mult;
+        /* guard lookup against out-of-range values */
+        hy=(hy<0?0:hy>255?255:hy);
 
         render_line(n,lx,hx,ly,hy,out);
 
-- 
2.7.4