Merge branch 'security-aosp-qt-release' into int/10/fp2
* security-aosp-qt-release:
handle cases where order isn't a multiple of dimension
Change-Id: I510d8c9de2128978877335ab4999166b3f23e698
diff --git a/Tremolo/treminfo.c b/Tremolo/treminfo.c
index 4f72728..09cb874 100644
--- a/Tremolo/treminfo.c
+++ b/Tremolo/treminfo.c
@@ -233,6 +233,7 @@
for(i=0;i<vc->comments;i++){
int len=oggpack_read(opb,32);
if(len<0)goto err_out;
+ if(len>1000000)goto err_out; /* disallow fields larger than 10 MB */
vc->comment_lengths[i]=len;
vc->user_comments[i]=(char *)_ogg_calloc(len+1,1);
if(!vc->user_comments[i])goto err_out;