Check dimensions against 0 too.
authorReinhard Tartler <siretart@tauware.de>
Tue, 9 Feb 2010 19:42:30 +0000 (19:42 +0000)
committerReinhard Tartler <siretart@tauware.de>
Tue, 9 Feb 2010 19:42:30 +0000 (19:42 +0000)
39_vorbis_zero_dims.patch from chrome

backport r19976 by michael

Originally committed as revision 21721 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5

libavcodec/vorbis_dec.c

index 6ca8763..a1e33ba 100644 (file)
@@ -249,8 +249,8 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc) {
         }
 
         codebook_setup->dimensions=get_bits(gb, 16);
-        if (codebook_setup->dimensions>16) {
-            av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is too large (%d). \n", cb, codebook_setup->dimensions);
+        if (codebook_setup->dimensions>16||codebook_setup->dimensions==0) {
+            av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is invalid (%d). \n", cb, codebook_setup->dimensions);
             goto error;
         }
         entries=get_bits(gb, 24);