# HG changeset patch # User michael # Date 1253694929 0 # Node ID 1792a26c0bbbbd9ab0769d9681eb88c99060598d # Parent e99054a89bfecddc1570752ad861a6c33634e189 Check dimensions against 0 too. 39_vorbis_zero_dims.patch from chrome diff -r e99054a89bfe -r 1792a26c0bbb vorbis_dec.c --- a/vorbis_dec.c Wed Sep 23 07:46:51 2009 +0000 +++ b/vorbis_dec.c Wed Sep 23 08:35:29 2009 +0000 @@ -244,8 +244,8 @@ } codebook_setup->dimensions=get_bits(gb, 16); - if (codebook_setup->dimensions>16) { - av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is too large (%d). \n", cb, codebook_setup->dimensions); + if (codebook_setup->dimensions>16||codebook_setup->dimensions==0) { + av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook's dimension is invalid (%d). \n", cb, codebook_setup->dimensions); goto error; } entries=get_bits(gb, 24);