1 diff --git a/media/libvorbis/lib/vorbis_floor1.c b/media/libvorbis/lib/vorbis_floor1.c
2 --- a/media/libvorbis/lib/vorbis_floor1.c
3 +++ b/media/libvorbis/lib/vorbis_floor1.c
4 @@ -162,16 +162,17 @@ static vorbis_info_floor *floor1_unpack
6 /* read the post list */
7 info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */
8 rangebits=oggpack_read(opb,4);
9 if(rangebits<0)goto err_out;
11 for(j=0,k=0;j<info->partitions;j++){
12 count+=info->class_dim[info->partitionclass[j]];
13 + if(count>VIF_POSIT) goto err_out;
15 int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
16 if(t<0 || t>=(1<<rangebits))
21 info->postlist[1]=1<<rangebits;