Skip to content
Snippets Groups Projects
Commit 550bb0a2 authored by Miika-Petteri Matikainen's avatar Miika-Petteri Matikainen
Browse files

Backport floo0 out-of-bounds write fix from main branch

Backports commit 80661a13 from
tremor main branch:

    floor0 code could potentially use a book where the number of vals it
    needed to decode was not an integer number of dims wide.  This caused
    it to overflow the output vector as the termination condition was in
    the outer loop of vorbis_book_decodev_set.

    None of the various vorbis_book_decodeXXXX calls internally guard
    against this case either, but in every other use the calling code does
    properly guard (and avoids putting more checks in the tight inner
    decode loop).

    For floor0, move the checks into the inner loop as there's little
    penalty for doing so.  Add commentary indicating where guarding is
    done for each call variant.
parent 293fd1c0
No related branches found
No related tags found
1 merge request!1Backport out-of-bounds fixes from master branch
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment