[FFmpeg-cvslog] r20411 - trunk/libavcodec/vorbis_dec.c

[Måns Rullgård]

Reimar D?ffinger <Reimar.Doeffinger at gmx.de> writes:

> On Fri, Jul 02, 2010 at 12:38:14AM +0100, M?ns Rullg?rd wrote:
>> reimar <subversion at mplayerhq.hu> writes:
>> 
>> > @@ -564,10 +571,7 @@ static int vorbis_parse_setup_hdr_floors
>> >                  int idx;
>> >                  uint_fast8_t book_idx;
>> >                  for (idx = 0; idx < floor_setup->data.t0.num_books; ++idx) {
>> > -                    book_idx = get_bits(gb, 8);
>> > -                    if (book_idx >= vc->codebook_count)
>> > -                        return -1;
>> > -                    floor_setup->data.t0.book_list[idx] = book_idx;
>> > +                    GET_VALIDATED_INDEX(floor_setup->data.t0.book_list[idx], 8, vc->codebook_count)
>> >                      if (vc->codebooks[book_idx].dimensions > max_codebook_dim)
>> >                          max_codebook_dim = vc->codebooks[book_idx].dimensions;
>> >                  }
>> 
>> This looks wrong.  book_idx is never written.
>
> I guess this should fix it?
> Index: vorbis_dec.c
> ===================================================================
> --- vorbis_dec.c        (revision 23825)
> +++ vorbis_dec.c        (working copy)
> @@ -569,7 +569,8 @@
>                  int idx;
>                  uint_fast8_t book_idx;
>                  for (idx = 0; idx < floor_setup->data.t0.num_books; ++idx) {
> -                    GET_VALIDATED_INDEX(floor_setup->data.t0.book_list[idx], 8, vc->codebook_count)
> +                    GET_VALIDATED_INDEX(book_idx, 8, vc->codebook_count)
> +                    floor_setup->data.t0.book_list[idx] = book_idx;
>                      if (vc->codebooks[book_idx].dimensions > max_codebook_dim)
>                          max_codebook_dim = vc->codebooks[book_idx].dimensions;
>                  }

Looks like it to me.

-- 
M?ns Rullg?rd
mans at mansr.com