Skip to content
  • Miika-Petteri Matikainen's avatar
    Backport floo0 out-of-bounds write fix from main branch · 550bb0a2
    Miika-Petteri Matikainen authored
    Backports commit 80661a13 from
    tremor main branch:
    
        floor0 code could potentially use a book where the number of vals it
        needed to decode was not an integer number of dims wide.  This caused
        it to overflow the output vector as the termination condition was in
        the outer loop of vorbis_book_decodev_set.
    
        None of the various vorbis_book_decodeXXXX calls internally guard
        against this case either, but in every other use the calling code does
        properly guard (and avoids putting more checks in the tight inner
        decode loop).
    
        For floor0, move the checks into the inner loop as there's little
        penalty for doing so.  Add commentary indicating where guarding is
        done for each call variant.
    550bb0a2