[SCM] libav/experimental: Check rangebits to avoid a possible crash. Fixes issue 2548 (and Chrome issue 68115 and unknown CERT issues).

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 13184036a6b1b1d4b61c91118c0896e9ad4634c3
Author: Frank Barchard <fbarchard at google.com>
Date:   Sat Jan 15 16:19:06 2011 +0000

    Check rangebits to avoid a possible crash.
    Fixes issue 2548 (and Chrome issue 68115 and unknown CERT issues).
    
    Patch by Frank Barchard, fbarchard at google
    
    Originally committed as revision 26365 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c
index 749e9a9..c2bde81 100644
--- a/libavcodec/vorbis_dec.c
+++ b/libavcodec/vorbis_dec.c
@@ -483,6 +483,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
         if (floor_setup->floor_type == 1) {
             int maximum_class = -1;
             uint_fast8_t  rangebits;
+            uint_fast32_t rangemax;
             uint_fast16_t floor1_values = 2;
 
             floor_setup->decode = vorbis_floor1_decode;
@@ -534,8 +535,15 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
 
 
             rangebits = get_bits(gb, 4);
+            rangemax = (1 << rangebits);
+            if (rangemax > vc->blocksize[1] / 2) {
+                av_log(vc->avccontext, AV_LOG_ERROR,
+                       "Floor value is too large for blocksize: %d (%d)\n",
+                       rangemax, vc->blocksize[1] / 2);
+                return -1;
+            }
             floor_setup->data.t1.list[0].x = 0;
-            floor_setup->data.t1.list[1].x = (1 << rangebits);
+            floor_setup->data.t1.list[1].x = rangemax;
 
             for (j = 0; j < floor_setup->data.t1.partitions; ++j) {
                 for (k = 0; k < floor_setup->data.t1.class_dimensions[floor_setup->data.t1.partition_class[j]]; ++k, ++floor1_values) {

-- 
Libav/FFmpeg packaging