Fix crash on corrupt input file (invalid mode index)
authorTim Terriberry <tterribe@xiph.org>
Sun, 4 Jan 2015 18:54:27 +0000 (18:54 +0000)
committerTim Terriberry <tterribe@xiph.org>
Sun, 4 Jan 2015 18:54:27 +0000 (18:54 +0000)
commitbd9e4426b408d3a32ad0dcd6846586837a00bd89
tree353d87178e814236dd78ab4ab2d47d13a36afcd0
parent3ed4ab1e50836828212ed2befe786ed3ac35fe67
Fix crash on corrupt input file (invalid mode index)

vorbis_packet_blocksize() crashes with a NULL pointer dereference,
if the "mode" index read from the packet is too large. Check this
immediately after reading the value and before accessing the mode
parameters. This crash potentially affects all users of libvorbisfile
and anyone else who calls vorbis_packet_blocksize() manually.

Patch by Martin Steghöfer <martin@steghoefer.eu>

Fixes #2140
Bug-Debian: https://bugs.debian.org/774516

svn path=/trunk/vorbis/; revision=19419
lib/synthesis.c