From fa50ef67450db16e7ce02d24b4614269c863de2e Mon Sep 17 00:00:00 2001
From: nls <nls@a1c6a512-1295-4272-9138-f99709370657>
Date: Tue, 7 Dec 2010 16:27:41 +0000
Subject: [PATCH] libtremor: merge upstream revision 17524 more sanity
 checking.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@28761 a1c6a512-1295-4272-9138-f99709370657
---
 apps/codecs/libtremor/res012.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/apps/codecs/libtremor/res012.c b/apps/codecs/libtremor/res012.c
index bcddf9764..1263fa65b 100644
--- a/apps/codecs/libtremor/res012.c
+++ b/apps/codecs/libtremor/res012.c
@@ -97,16 +97,27 @@ static vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
   info->partitions=oggpack_read(opb,6)+1;
   info->groupbook=oggpack_read(opb,8);
 
+  /* check for premature EOP */
+  if(info->groupbook<0)goto errout;
+
   for(j=0;j<info->partitions;j++){
     int cascade=oggpack_read(opb,3);
-    if(oggpack_read(opb,1))
-      cascade|=(oggpack_read(opb,5)<<3);
+    int cflag=oggpack_read(opb,1);
+    if(cflag<0) goto errout;
+    if(cflag){
+      int c=oggpack_read(opb,5);
+      if(c<0) goto errout;
+      cascade|=(c<<3);
+    }
     info->secondstages[j]=cascade;
 
     acc+=icount(cascade);
   }
-  for(j=0;j<acc;j++)
-    info->booklist[j]=oggpack_read(opb,8);
+  for(j=0;j<acc;j++){
+    int book=oggpack_read(opb,8);
+    if(book<0) goto errout;
+    info->booklist[j]=book;
+  }
 
   if(info->groupbook>=ci->books)goto errout;
   for(j=0;j<acc;j++){
-- 
2.11.4.GIT