From 98f7bcb119c5c3517c811350fe1451cf3a83f9c9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 23 Sep 2009 08:35:29 +0000 Subject: [PATCH] Check dimensions against 0 too. 39_vorbis_zero_dims.patch from chrome Originally committed as revision 19976 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/vorbis_dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c index 00542b9596..25cfb31c86 100644 --- a/libavcodec/vorbis_dec.c +++ b/libavcodec/vorbis_dec.c @@ -244,8 +244,8 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc) { } codebook_setup->dimensions=get_bits(gb, 16); - if (codebook_setup->dimensions>16) { - av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is too large (%d). \n", cb, codebook_setup->dimensions); + if (codebook_setup->dimensions>16||codebook_setup->dimensions==0) { + av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is invalid (%d). \n", cb, codebook_setup->dimensions); goto error; } entries=get_bits(gb, 24);