Bug 507167 and Bug 518941 - Update libvorbis to SVN r16597 to pick up recent fixes. r=chris.double, rs=roc

--HG--
extra : rebase_source : e941bcd256dd233304c6095d9d66ad1a96061ce2

content/media/test/Makefile.in

@@ -116,6 +116,7 @@ _TEST_FILES += \
 		320x240.allow-origin.ogv \
 		320x240.allow-origin.ogv^headers^ \
 		448636.ogv \
+		beta-phrasebook.ogg \
 		bogus.ogv \
 		bug495129.ogv \
 		bug461281.ogg \

content/media/test/manifest.js

@@ -17,10 +17,9 @@ var gSmallTests = [
   { name:"bogus.duh", type:"bogus/duh" }
 ];
 
-// These are files that must fire an error during load or playback, and do not
-// cause a crash.  Put files of the same type together in this list so if
-// something crashes we have some idea of which backend is responsible.  Used
-// by test_playback_errors, which expects one error event and no ended event.
+// These are files that we just want to make sure we can play through.  We can
+// also check metadata.  Put files of the same type together in this list so if
+// something crashes we have some idea of which backend is responsible.
 var gPlayTests = [
   // 8-bit samples
   { name:"r11025_u8_c1.wav", type:"audio/x-wav", duration:1.0 },
@@ -44,12 +43,16 @@ var gPlayTests = [
   { name:"bug504613.ogv", type:"video/ogg" },
   // Multiple audio streams.
   { name:"bug516323.ogv", type:"video/ogg", duration:4.424 },
+  // Encoded with vorbis beta1, includes unusually sized codebooks
+  { name:"beta-phrasebook.ogg", type:"audio/ogg", duration:4 },
 
   { name:"bogus.duh", type:"bogus/duh" }
 ];
 
-// These are files that should refuse to play and report an error,
-// without crashing of course.
+// These are files that must fire an error during load or playback, and do not
+// cause a crash.  Put files of the same type together in this list so if
+// something crashes we have some idea of which backend is responsible.  Used
+// by test_playback_errors, which expects one error event and no ended event.
 // Put files of the same type together in this list so if something crashes
 // we have some idea of which backend is responsible.
 var gErrorTests = [

media/libvorbis/README_MOZILLA

@@ -3,7 +3,7 @@ subversion repository using the update.sh script. The only changes
 made were those applied by update.sh and the addition/upate of
 Makefile.in files for the Mozilla build system.
 
-The svn revision number used was r16335.
+The svn revision number used was r16597.
 
 Some files are renamed during the copy to prevent clashes with object
 file names with other Mozilla libraries.

media/libvorbis/lib/backends.h

@@ -12,7 +12,7 @@
 
  function: libvorbis backend and mapping structures; needed for
            static mode headers
- last mod: $Id: backends.h 16326 2009-07-24 00:06:53Z xiphmont $
+ last mod: $Id: backends.h 16552 2009-09-12 02:09:04Z xiphmont $
 
  ********************************************************************/
 
@@ -109,6 +109,7 @@ typedef struct vorbis_info_residue0{
   /* first stage (lossless partitioning) */
   int    grouping;         /* group n vectors per partition */
   int    partitions;       /* possible codebooks for a partition */
+  int    partvals;         /* partitions ^ groupbook dim */
   int    groupbook;        /* huffbook for partitioning */
   int    secondstages[64]; /* expanded out to pointers in lookup */
   int    booklist[512];    /* list of second stage books */

media/libvorbis/lib/vorbis_codebook.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: basic codebook pack/unpack/code/decode operations
- last mod: $Id: codebook.c 16227 2009-07-08 06:58:46Z xiphmont $
+ last mod: $Id: codebook.c 16597 2009-10-01 02:54:22Z tterribe $
 
  ********************************************************************/
 
@@ -198,6 +198,7 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){
       for(i=0;i<s->entries;){
         long num=oggpack_read(opb,_ilog(s->entries-i));
         if(num==-1)goto _eofout;
+        if(length>32)goto _errout;
         for(j=0;j<num && i<s->entries;j++,i++)
           s->lengthlist[i]=length;
         length++;

media/libvorbis/lib/vorbis_res0.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: residue backend 0, 1 and 2 implementation
- last mod: $Id: res0.c 16327 2009-07-24 00:49:25Z xiphmont $
+ last mod: $Id: res0.c 16552 2009-09-12 02:09:04Z xiphmont $
 
  ********************************************************************/
 
@@ -238,6 +238,10 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
 
   /* verify the phrasebook is not specifying an impossible or
      inconsistent partitioning scheme. */
+  /* modify the phrasebook ranging check from r16327; an early beta
+     encoder had a bug where it used an oversized phrasebook by
+     accident.  These files should continue to be playable, but don't
+     allow an exploit */
   {
     int entries = ci->book_param[info->groupbook]->entries;
     int dim = ci->book_param[info->groupbook]->dim;
@@ -247,7 +251,7 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
       if(partvals > entries) goto errout;
       dim--;
     }
-    if(partvals < entries) goto errout;
+    info->partvals = partvals;
   }
 
   return(info);
@@ -668,7 +672,7 @@ static int _01inverse(vorbis_block *vb,vorbis_look_residue *vl,
           for(j=0;j<ch;j++){
             int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
 
-            if(temp==-1)goto eopbreak;
+            if(temp==-1 || temp>=info->partvals)goto eopbreak;
             partword[j][l]=look->decodemap[temp];
             if(partword[j][l]==NULL)goto errout;
           }
@@ -884,7 +888,7 @@ int res2_inverse(vorbis_block *vb,vorbis_look_residue *vl,
         if(s==0){
           /* fetch the partition word */
           int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-          if(temp==-1)goto eopbreak;
+          if(temp==-1 || temp>info->partvals)goto eopbreak;
           partword[l]=look->decodemap[temp];
           if(partword[l]==NULL)goto errout;
         }