Commit 8cac86e0 authored by Michael Niedermayer's avatar Michael Niedermayer

vorbisdec: fix heap buffer overflow.

Found-by: 's avatarDale Curtis <dalecurtis@chromium.org>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent a6aa7e03
......@@ -1411,7 +1411,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
}
} else if (vr_type == 2) {
unsigned voffs_div = FASTDIV(voffset, ch);
unsigned voffs_div = ch == 1 ? voffset : FASTDIV(voffset, ch);
unsigned voffs_mod = voffset - voffs_div * ch;
for (k = 0; k < step; ++k) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment