commit | 36ec928f52271dd1feb4c86b18026564220629e9 | [log] [tgz] |
---|---|---|
author | Marco Nelissen <marcone@google.com> | Tue May 12 13:04:25 2015 -0700 |
committer | Abhishek Arya <aarya@google.com> | Sat Aug 15 05:13:51 2015 +0000 |
tree | 24132fb30da63b3a4679d63aed6445a95705fe8b | |
parent | 2e941e40ce76eb13b273479a4ee8fb6e40d33795 [diff] |
Fix vorbis decoder crash due to out of bounds memory access Bug: 20915134 Change-Id: Ia7b503910b2fd0a4e3931837bd55dff3ea28ce86 (cherry picked from commit c7fdab4f4832fbe4ab9655f91dbed6b3878fe4b7)
diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c index a2a035b..4a4937d 100644 --- a/Tremolo/floor1.c +++ b/Tremolo/floor1.c
@@ -232,8 +232,9 @@ if(n>x1)n=x1; n -= x0; - if (n <= 0) + if (n <= 0 || y0 < 0 || y0 > 255 || y1 < 0 || y1 > 255) { return; + } dy=y1-y0; adx=x1-x0; ady=abs(dy);