1 files changed, 23 insertions, 0 deletions
diff --git a/audio/libvorbis/files/patch-lib_codebook.c b/audio/libvorbis/files/patch-lib_codebook.c
new file mode 100644
index 000000000000..ac555bdcf7b7
--- /dev/null
+++ b/audio/libvorbis/files/patch-lib_codebook.c
@@ -0,0 +1,23 @@
+
+$FreeBSD$
+
+--- lib/codebook.c.orig
++++ lib/codebook.c
+@@ -159,6 +159,8 @@
+   s->entries=oggpack_read(opb,24);
+   if(s->entries==-1)goto _eofout;
+ 
++  if(_ilog(s->dim)+_ilog(s->entries)>24)goto _eofout;
++
+   /* codeword ordering.... length ordered or unordered? */
+   switch((int)oggpack_read(opb,1)){
+   case 0:
+@@ -225,7 +227,7 @@
+       int quantvals=0;
+       switch(s->maptype){
+       case 1:
+-	quantvals=_book_maptype1_quantvals(s);
++	quantvals=(s->dim==0?0:_book_maptype1_quantvals(s));
+ 	break;
+       case 2:
+ 	quantvals=s->entries*s->dim;