comparison vorbis_dec.c @ 12347:bc21b45eba99 libavcodec

vorbisdec: Prevent a potential integer overflow. If sizeof uint_fast8_t > 1 and sizeof size_t <= 4, the expression that mallocs classifs is susceptible to integer overflow.

12346:015c13a563dd

    uint_fast8_t  classifications;
    uint_fast8_t  classbook;
    int_fast16_t  books[64][8];
    uint_fast8_t  maxpass;
    uint_fast16_t ptns_to_read;
    uint_fast8_t *classifs;
} vorbis_residue;

typedef struct {
    uint_fast8_t  submaps;
    uint_fast16_t coupling_steps;

                                                           int vr_type)
{
    GetBitContext *gb = &vc->gb;
    uint_fast8_t c_p_c = vc->codebooks[vr->classbook].dimensions;
    uint_fast16_t ptns_to_read = vr->ptns_to_read;
    uint_fast8_t *classifs = vr->classifs;
    uint_fast8_t pass;
    uint_fast8_t ch_used;
    uint_fast8_t i,j,l;
    uint_fast16_t k;

12347:bc21b45eba99

    uint_fast8_t  classifications;
    uint_fast8_t  classbook;
    int_fast16_t  books[64][8];
    uint_fast8_t  maxpass;
    uint_fast16_t ptns_to_read;
    uint8_t *classifs;
} vorbis_residue;

typedef struct {
    uint_fast8_t  submaps;
    uint_fast16_t coupling_steps;

                                                           int vr_type)
{
    GetBitContext *gb = &vc->gb;
    uint_fast8_t c_p_c = vc->codebooks[vr->classbook].dimensions;
    uint_fast16_t ptns_to_read = vr->ptns_to_read;
    uint8_t *classifs = vr->classifs;
    uint_fast8_t pass;
    uint_fast8_t ch_used;
    uint_fast8_t i,j,l;
    uint_fast16_t k;