Bug 600776 - Update in-tree libvorbis to 1.3.2. rs=doublec a=blocking2.0:final+

media/libvorbis/README_MOZILLA

@@ -3,10 +3,9 @@ subversion repository using the update.sh script. The only changes
 made were those applied by update.sh and the addition/upate of
 Makefile.in files for the Mozilla build system.
 
-The upstream release used was libvorbis 1.3.1.
+The upstream release used was libvorbis 1.3.2 (SVN r17614).
 
 Some files are renamed during the copy to prevent clashes with object
 file names with other Mozilla libraries.
 
 alloca.diff - Bug 469639 - Failed to build firefox trunk on OpenSolaris
-bug487519.patch: fix for bug 487519.

media/libvorbis/bug487519.patch

@@ -1,20 +0,0 @@
-diff --git a/media/libvorbis/lib/vorbis_synthesis.c b/media/libvorbis/lib/vorbis_synthesis.c
-index 8872f57..b7b2399 100644
---- a/media/libvorbis/lib/vorbis_synthesis.c
-+++ b/media/libvorbis/lib/vorbis_synthesis.c
-@@ -43,9 +43,14 @@ int vorbis_synthesis(vorbis_block *vb,ogg_packet *op){
- 
-   /* read our mode and pre/post windowsize */
-   mode=oggpack_read(opb,b->modebits);
--  if(mode==-1)return(OV_EBADPACKET);
-+  if(mode==-1) {
-+    return(OV_EBADPACKET);
-+  }
- 
-   vb->mode=mode;
-+  if(!ci->mode_param[mode]) {
-+    return(OV_EBADPACKET); 
-+  }
-   vb->W=ci->mode_param[mode]->blockflag;
-   if(vb->W){
- 

media/libvorbis/lib/highlevel.h

@@ -10,8 +10,8 @@
  *                                                                  *
  ********************************************************************
 
- function: highlevel encoder setup struct seperated out for vorbisenc clarity
- last mod: $Id: highlevel.h 16995 2010-03-23 03:44:44Z xiphmont $
+ function: highlevel encoder setup struct separated out for vorbisenc clarity
+ last mod: $Id: highlevel.h 17195 2010-05-05 21:49:51Z giles $
 
  ********************************************************************/
 

media/libvorbis/lib/vorbis_block.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: PCM data vector blocking, windowing and dis/reassembly
- last mod: $Id: block.c 16330 2009-07-24 01:58:50Z xiphmont $
+ last mod: $Id: block.c 17561 2010-10-23 10:34:24Z xiphmont $
 
  Handle windowing, overlap-add, etc of the PCM vectors.  This is made
  more amusing by Vorbis' current two allowed block sizes.
@@ -232,16 +232,17 @@ static int _vds_shared_init(vorbis_dsp_state *v,vorbis_info *vi,int encp){
     v->analysisp=1;
   }else{
     /* finish the codebooks */
-    if(!ci->fullbooks)
+    if(!ci->fullbooks){
       ci->fullbooks=_ogg_calloc(ci->books,sizeof(*ci->fullbooks));
-    for(i=0;i<ci->books;i++){
-      if(ci->book_param[i]==NULL)
-        goto abort_books;
-      if(vorbis_book_init_decode(ci->fullbooks+i,ci->book_param[i]))
-        goto abort_books;
+      for(i=0;i<ci->books;i++){
+        if(ci->book_param[i]==NULL)
+          goto abort_books;
+        if(vorbis_book_init_decode(ci->fullbooks+i,ci->book_param[i]))
+          goto abort_books;
         /* decode codebooks are now standalone after init */
-      vorbis_staticbook_destroy(ci->book_param[i]);
-      ci->book_param[i]=NULL;
+        vorbis_staticbook_destroy(ci->book_param[i]);
+        ci->book_param[i]=NULL;
+      }
     }
   }
 
@@ -859,17 +860,32 @@ int vorbis_synthesis_blockin(vorbis_dsp_state *v,vorbis_block *vb){
       if(b->sample_count>v->granulepos){
         /* corner case; if this is both the first and last audio page,
            then spec says the end is cut, not beginning */
+       long extra=b->sample_count-vb->granulepos;
+
+        /* we use ogg_int64_t for granule positions because a
+           uint64 isn't universally available.  Unfortunately,
+           that means granposes can be 'negative' and result in
+           extra being negative */
+        if(extra<0)
+          extra=0;
+
         if(vb->eofflag){
           /* trim the end */
-          /* no preceeding granulepos; assume we started at zero (we'd
+          /* no preceding granulepos; assume we started at zero (we'd
              have to in a short single-page stream) */
           /* granulepos could be -1 due to a seek, but that would result
              in a long count, not short count */
 
-          v->pcm_current-=(b->sample_count-v->granulepos)>>hs;
+          /* Guard against corrupt/malicious frames that set EOP and
+             a backdated granpos; don't rewind more samples than we
+             actually have */
+          if(extra > (v->pcm_current - v->pcm_returned)<<hs)
+            extra = (v->pcm_current - v->pcm_returned)<<hs;
+
+          v->pcm_current-=extra>>hs;
         }else{
           /* trim the beginning */
-          v->pcm_returned+=(b->sample_count-v->granulepos)>>hs;
+          v->pcm_returned+=extra>>hs;
           if(v->pcm_returned>v->pcm_current)
             v->pcm_returned=v->pcm_current;
         }
@@ -887,6 +903,20 @@ int vorbis_synthesis_blockin(vorbis_dsp_state *v,vorbis_block *vb){
         if(extra)
           if(vb->eofflag){
             /* partial last frame.  Strip the extra samples off */
+
+            /* Guard against corrupt/malicious frames that set EOP and
+               a backdated granpos; don't rewind more samples than we
+               actually have */
+            if(extra > (v->pcm_current - v->pcm_returned)<<hs)
+              extra = (v->pcm_current - v->pcm_returned)<<hs;
+
+            /* we use ogg_int64_t for granule positions because a
+               uint64 isn't universally available.  Unfortunately,
+               that means granposes can be 'negative' and result in
+               extra being negative */
+            if(extra<0)
+              extra=0;
+
             v->pcm_current-=extra>>hs;
           } /* else {Shouldn't happen *unless* the bitstream is out of
                spec.  Either way, believe the bitstream } */

media/libvorbis/lib/vorbis_codebook.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: basic codebook pack/unpack/code/decode operations
- last mod: $Id: codebook.c 17030 2010-03-25 06:52:55Z xiphmont $
+ last mod: $Id: codebook.c 17553 2010-10-21 17:54:26Z tterribe $
 
  ********************************************************************/
 
@@ -163,12 +163,17 @@ static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
 
   /* codeword ordering.... length ordered or unordered? */
   switch((int)oggpack_read(opb,1)){
-  case 0:
+  case 0:{
+    long unused;
+    /* allocated but unused entries? */
+    unused=oggpack_read(opb,1);
+    if((s->entries*(unused?1:5)+7)>>3>opb->storage-oggpack_bytes(opb))
+      goto _eofout;
     /* unordered */
     s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
 
     /* allocated but unused entries? */
-    if(oggpack_read(opb,1)){
+    if(unused){
       /* yes, unused entries */
 
       for(i=0;i<s->entries;i++){
@@ -189,17 +194,23 @@ static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
     }
 
     break;
+  }
   case 1:
     /* ordered */
     {
       long length=oggpack_read(opb,5)+1;
+      if(length==0)goto _eofout;
       s->lengthlist=_ogg_malloc(sizeof(*s->lengthlist)*s->entries);
 
       for(i=0;i<s->entries;){
         long num=oggpack_read(opb,_ilog(s->entries-i));
         if(num==-1)goto _eofout;
+        if(length>32 || num>s->entries-i ||
+           (num>0 && (num-1)>>(length-1)>1)){
+          goto _errout;
+        }
         if(length>32)goto _errout;
-        for(j=0;j<num && i<s->entries;j++,i++)
+        for(j=0;j<num;j++,i++)
           s->lengthlist[i]=length;
         length++;
       }
@@ -237,6 +248,8 @@ static_codebook *vorbis_staticbook_unpack(oggpack_buffer *opb){
       }
 
       /* quantized values */
+      if((quantvals*s->q_quant+7>>3)>opb->storage-oggpack_bytes(opb))
+        goto _eofout;
       s->quantlist=_ogg_malloc(sizeof(*s->quantlist)*quantvals);
       for(i=0;i<quantvals;i++)
         s->quantlist[i]=oggpack_read(opb,s->q_quant);

media/libvorbis/lib/vorbis_floor0.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: floor backend 0 implementation
- last mod: $Id: floor0.c 16227 2009-07-08 06:58:46Z xiphmont $
+ last mod: $Id: floor0.c 17558 2010-10-22 00:24:41Z tterribe $
 
  ********************************************************************/
 
@@ -91,6 +91,8 @@ static vorbis_info_floor *floor0_unpack (vorbis_info *vi,oggpack_buffer *opb){
   for(j=0;j<info->numbooks;j++){
     info->books[j]=oggpack_read(opb,8);
     if(info->books[j]<0 || info->books[j]>=ci->books)goto err_out;
+    if(ci->book_param[info->books[j]]->maptype==0)goto err_out;
+    if(ci->book_param[info->books[j]]->dim<1)goto err_out;
   }
   return(info);
 

media/libvorbis/lib/vorbis_floor1.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: floor backend 1 implementation
- last mod: $Id: floor1.c 17079 2010-03-26 06:51:41Z xiphmont $
+ last mod: $Id: floor1.c 17555 2010-10-21 18:14:51Z tterribe $
 
  ********************************************************************/
 
@@ -1035,7 +1035,7 @@ static void *floor1_inverse1(vorbis_block *vb,vorbis_look_floor *in){
           }
         }
 
-        fit_value[i]=val+predicted;
+        fit_value[i]=val+predicted&0x7fff;
         fit_value[look->loneighbor[i-2]]&=0x7fff;
         fit_value[look->hineighbor[i-2]]&=0x7fff;
 
@@ -1066,13 +1066,18 @@ static int floor1_inverse2(vorbis_block *vb,vorbis_look_floor *in,void *memo,
     int hx=0;
     int lx=0;
     int ly=fit_value[0]*info->mult;
+    /* guard lookup against out-of-range values */
+    ly=(ly<0?0:ly>255?255:ly);
+
     for(j=1;j<look->posts;j++){
       int current=look->forward_index[j];
       int hy=fit_value[current]&0x7fff;
       if(hy==fit_value[current]){
 
-        hy*=info->mult;
         hx=info->postlist[current];
+        hy*=info->mult;
+        /* guard lookup against out-of-range values */
+        hy=(hy<0?0:hy>255?255:hy);
 
         render_line(n,lx,hx,ly,hy,out);
 

media/libvorbis/lib/vorbis_info.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: maintain the info structure, info <-> header packets
- last mod: $Id: info.c 17080 2010-03-26 06:59:58Z xiphmont $
+ last mod: $Id: info.c 17584 2010-11-01 19:26:16Z xiphmont $
 
  ********************************************************************/
 
@@ -31,8 +31,8 @@
 #include "misc.h"
 #include "os.h"
 
-#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.1"
-#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20100325 (Everywhere)"
+#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.2"
+#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20101101 (Schaufenugget)"
 
 /* helpers */
 static int ilog2(unsigned int v){
@@ -645,9 +645,18 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
 }
 
 double vorbis_granule_time(vorbis_dsp_state *v,ogg_int64_t granulepos){
-  if(granulepos>=0)
+  if(granulepos == -1) return -1;
+
+  /* We're not guaranteed a 64 bit unsigned type everywhere, so we
+     have to put the unsigned granpo in a signed type. */
+  if(granulepos>=0){
     return((double)granulepos/v->vi->rate);
-  return(-1);
+  }else{
+    ogg_int64_t granuleoff=0xffffffff;
+    granuleoff<<=31;
+    granuleoff|=0x7ffffffff;
+    return(((double)granulepos+2+granuleoff+granuleoff)/v->vi->rate);
+  }
 }
 
 const char *vorbis_version_string(void){

media/libvorbis/lib/vorbis_lsp.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
   function: LSP (also called LSF) conversion routines
-  last mod: $Id: lsp.c 16227 2009-07-08 06:58:46Z xiphmont $
+  last mod: $Id: lsp.c 17538 2010-10-15 02:52:29Z tterribe $
 
   The LSP generation code is taken (with minimal modification and a
   few bugfixes) from "On the Computation of the LSP Frequencies" by
@@ -46,7 +46,7 @@
    implementation.  The float lookup is likely the optimal choice on
    any machine with an FPU.  The integer implementation is *not* fixed
    point (due to the need for a large dynamic range and thus a
-   seperately tracked exponent) and thus much more complex than the
+   separately tracked exponent) and thus much more complex than the
    relatively simple float implementations. It's mostly for future
    work on a fully fixed point implementation for processors like the
    ARM family. */
@@ -81,11 +81,11 @@ void vorbis_lsp_to_curve(float *curve,int *map,int n,int ln,float *lsp,int m,
     float *ftmp=lsp;
     int c=m>>1;
 
-    do{
+    while(c--){
       q*=ftmp[0]-w;
       p*=ftmp[1]-w;
       ftmp+=2;
-    }while(--c);
+    }
 
     if(m&1){
       /* odd order filter; slightly assymetric */

media/libvorbis/lib/vorbis_psy.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: psychoacoustics not including preecho
- last mod: $Id: psy.c 17077 2010-03-26 06:22:19Z xiphmont $
+ last mod: $Id: psy.c 17569 2010-10-26 17:09:47Z xiphmont $
 
  ********************************************************************/
 
@@ -1160,14 +1160,22 @@ void _vp_couple_quantize_normalize(int blobno,
                     However, this is a temporary patch.
                     by Aoyumi @ 2004/04/18
                 */
-                float derate = (1.0 - de*((float)(j-limit+i) / (float)(n-limit)));
-
-                /* elliptical */
+                /*float derate = (1.0 - de*((float)(j-limit+i) / (float)(n-limit)));
+                /* elliptical 
                 if(reM[j]+reA[j]<0){
                   reM[j] = - (qeM[j] = (fabs(reM[j])+fabs(reA[j]))*derate*derate);
                 }else{
                   reM[j] =   (qeM[j] = (fabs(reM[j])+fabs(reA[j]))*derate*derate);
+                  }*/
+
+                /* elliptical */
+                if(reM[j]+reA[j]<0){
+                  reM[j] = - (qeM[j] = fabs(reM[j])+fabs(reA[j]));
+                }else{
+                  reM[j] =   (qeM[j] = fabs(reM[j])+fabs(reA[j]));
                 }
+
+
               }
               reA[j]=qeA[j]=0.f;
               fA[j]=1;

media/libvorbis/lib/vorbis_res0.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: residue backend 0, 1 and 2 implementation
- last mod: $Id: res0.c 16962 2010-03-11 07:30:34Z xiphmont $
+ last mod: $Id: res0.c 17556 2010-10-21 18:25:19Z tterribe $
 
  ********************************************************************/
 
@@ -250,6 +250,7 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
     int entries = ci->book_param[info->groupbook]->entries;
     int dim = ci->book_param[info->groupbook]->dim;
     int partvals = 1;
+    if (dim<1) goto errout;
     while(dim>0){
       partvals *= info->partitions;
       if(partvals > entries) goto errout;
@@ -828,7 +829,7 @@ int res2_inverse(vorbis_block *vb,vorbis_look_residue *vl,
         if(s==0){
           /* fetch the partition word */
           int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-          if(temp==-1 || temp>info->partvals)goto eopbreak;
+          if(temp==-1 || temp>=info->partvals)goto eopbreak;
           partword[l]=look->decodemap[temp];
           if(partword[l]==NULL)goto errout;
         }

media/libvorbis/lib/vorbis_synthesis.c

@@ -11,7 +11,7 @@
  ********************************************************************
 
  function: single-block PCM synthesis
- last mod: $Id: synthesis.c 17027 2010-03-25 05:21:20Z xiphmont $
+ last mod: $Id: synthesis.c 17474 2010-09-30 03:41:41Z gmaxwell $
 
  ********************************************************************/
 
@@ -111,14 +111,13 @@ int vorbis_synthesis_trackonly(vorbis_block *vb,ogg_packet *op){
 
   /* read our mode and pre/post windowsize */
   mode=oggpack_read(opb,b->modebits);
-  if(mode==-1) {
-    return(OV_EBADPACKET);
-  }
+  if(mode==-1)return(OV_EBADPACKET);
 
   vb->mode=mode;
-  if(!ci->mode_param[mode]) {
-    return(OV_EBADPACKET); 
+  if(!ci->mode_param[mode]){
+    return(OV_EBADPACKET);
   }
+  
   vb->W=ci->mode_param[mode]->blockflag;
   if(vb->W){
     vb->lW=oggpack_read(opb,1);

media/libvorbis/update.sh

@@ -47,4 +47,3 @@ cp $1/COPYING ./COPYING
 cp $1/README ./README
 cp $1/AUTHORS ./AUTHORS
 patch -p3 < ./alloca.diff
-patch -p3 <bug487519.patch