diff --git a/floor1.c b/floor1.c index a0135527162d1f47f115bad070f37e2eb7ecac11..e63ae9fb34b76e86153784f0e865683c80e4d21e 100644 --- a/floor1.c +++ b/floor1.c @@ -108,6 +108,7 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){ for(j=0,k=0;j<info->partitions;j++){ count+=info->class_dim[info->partitionclass[j]]; + if(count>VIF_POSIT)goto err_out; for(;k<count;k++){ int t=info->postlist[k+2]=oggpack_read(opb,rangebits); if(t<0 || t>=(1<<rangebits))