diff options
| author | Marco Nelissen <marcone@google.com> | 2015-05-12 13:04:25 -0700 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-19 01:20:52 +0200 |
| commit | 0982810d2495eb7c6e79e46db19a6e5ea41bc7ba (patch) | |
| tree | e72b9ac8270dc48b519fa0569f185955ca938dad | |
| parent | 3eec17965b3e2974e120e864b351a916f59835ba (diff) | |
| download | external_tremolo-0982810d2495eb7c6e79e46db19a6e5ea41bc7ba.zip external_tremolo-0982810d2495eb7c6e79e46db19a6e5ea41bc7ba.tar.gz external_tremolo-0982810d2495eb7c6e79e46db19a6e5ea41bc7ba.tar.bz2 | |
Fix vorbis decoder crash due to out of bounds memory access
Bug: 20915134
Change-Id: Ia7b503910b2fd0a4e3931837bd55dff3ea28ce86
(cherry picked from commit c7fdab4f4832fbe4ab9655f91dbed6b3878fe4b7)
Tested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
| -rw-r--r-- | Tremolo/floor1.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c index a2a035b..4a4937d 100644 --- a/Tremolo/floor1.c +++ b/Tremolo/floor1.c @@ -232,8 +232,9 @@ static void render_line(int n,int x0,int x1,int y0,int y1,ogg_int32_t *d){ if(n>x1)n=x1; n -= x0; - if (n <= 0) + if (n <= 0 || y0 < 0 || y0 > 255 || y1 < 0 || y1 > 255) { return; + } dy=y1-y0; adx=x1-x0; ady=abs(dy); |