commit 8ab66384515f19dcdcddd51fb86e77864cf9d747
author Marco Nelissen <marcone@google.com> Tue May 12 13:04:25 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 13:59:30 2015 -0700
tree 245841dfd3b094458ccafa543fd8ca2c200d7f4a
parent bc8326c35c382ea2d150eb3998c717d2858219e3

Fix vorbis decoder crash due to out of bounds memory access

Bug: 20915134
Change-Id: Ia7b503910b2fd0a4e3931837bd55dff3ea28ce86
(cherry picked from commit c7fdab4f4832fbe4ab9655f91dbed6b3878fe4b7)

Tremolo/floor1.c

diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c
index a2a035b..4a4937d 100644
--- a/Tremolo/floor1.c
+++ b/Tremolo/floor1.c
@@ -232,8 +232,9 @@
 
   if(n>x1)n=x1;
   n -= x0;
-  if (n <= 0)
+  if (n <= 0 || y0 < 0 || y0 > 255 || y1 < 0 || y1 > 255) {
     return;
+  }
   dy=y1-y0;
   adx=x1-x0;
   ady=abs(dy);