[FFmpeg-devel] [PATCH] Fix a couple of errors with bad Vorbis headers

[Frank Barchard]

Reimar,
On Wed, Dec 29, 2010 at 7:01 AM, Reimar D?ffinger
<Reimar.Doeffinger at gmx.de>wrote:

> On Tue, Dec 28, 2010 at 08:19:03PM -0800, Alex Converse wrote:
> > @@ -536,6 +536,12 @@ static int vorbis_parse_setup_hdr_floors
> >              rangebits = get_bits(gb, 4);
> >              floor_setup->data.t1.list[0].x = 0;
> >              floor_setup->data.t1.list[1].x = (1 << rangebits);
> > +            if (floor_setup->data.t1.list[1].x > vc->blocksize[1] / 2) {
> > +                av_log(vc->avccontext, AV_LOG_ERROR,
> > +                       "Floor value is too large for blocksize: %d
> (%d)\n",
> > +                       floor_setup->data.t1.list[1].x, vc->blocksize[1]
> / 2);
> > +                return -1;
> > +            }
> >
>
> You leave the invalid value in there, this is quite risky IMO.
>

Are you suggesting adding:
 floor_setup->data.t1.list[1].x = 0;
before the return -1 ?