rpms/libvorbis/FC-6 r13149.patch, NONE, 1.1 r13151.patch, NONE, 1.1 r13153.patch, NONE, 1.1 r13154.patch, NONE, 1.1 r13155.patch, NONE, 1.1 r13160-CVE-2007-3106.patch, NONE, 1.1 r13162.patch, NONE, 1.1 r13167.patch, NONE, 1.1 r13168.patch, NONE, 1.1 r13169.patch, NONE, 1.1 r13170.patch, NONE, 1.1 r13172.patch, NONE, 1.1 r13179.patch, NONE, 1.1 r13211.patch, NONE, 1.1 r13215.patch, NONE, 1.1 r13217-CVE-2007-4065.patch, NONE, 1.1 libvorbis.spec, 1.24, 1.25

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Fri Aug 10 01:32:53 UTC 2007


Author: besfahbo

Update of /cvs/dist/rpms/libvorbis/FC-6
In directory cvs.devel.redhat.com:/tmp/cvs-serv4355

Modified Files:
	libvorbis.spec 
Added Files:
	r13149.patch r13151.patch r13153.patch r13154.patch 
	r13155.patch r13160-CVE-2007-3106.patch r13162.patch 
	r13167.patch r13168.patch r13169.patch r13170.patch 
	r13172.patch r13179.patch r13211.patch r13215.patch 
	r13217-CVE-2007-4065.patch 
Log Message:
* Thu Aug  9 2007 Behdad Esfahbod <besfahbo at redhat.com> - 1:1.1.2-3
- Add 16 patches to fix various CVEs.
- Resolves: #250600


r13149.patch:
 info.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE r13149.patch ---
Index: lib/info.c
===================================================================
--- lib/info.c	(revision 13148)
+++ lib/info.c	(revision 13149)
@@ -211,7 +211,7 @@ static int _vorbis_unpack_info(vorbis_in
   
   if(vi->rate<1)goto err_out;
   if(vi->channels<1)goto err_out;
-  if(ci->blocksizes[0]<8)goto err_out; 
+  if(ci->blocksizes[0]<64)goto err_out; 
   if(ci->blocksizes[1]<ci->blocksizes[0])goto err_out;
   
   if(oggpack_read(opb,1)!=1)goto err_out; /* EOP check */

r13151.patch:
 floor1.c |   12 +
 res0.c   |  469 ++++++++++++++++++++++++++++++++-------------------------------
 2 files changed, 251 insertions(+), 230 deletions(-)

--- NEW FILE r13151.patch ---
Index: lib/floor1.c
===================================================================
--- lib/floor1.c	(revision 13150)
+++ lib/floor1.c	(revision 13151)
@@ -358,7 +358,7 @@ static float FLOOR1_fromdB_LOOKUP[256]={
   0.82788260F, 0.88168307F, 0.9389798F, 1.F, 
 };
 
-static void render_line(int x0,int x1,int y0,int y1,float *d){
+static void render_line(int n, int x0,int x1,int y0,int y1,float *d){
   int dy=y1-y0;
   int adx=x1-x0;
   int ady=abs(dy);
@@ -370,8 +370,12 @@ static void render_line(int x0,int x1,in
 
   ady-=abs(base*adx);
 
-  d[x]*=FLOOR1_fromdB_LOOKUP[y];
-  while(++x<x1){
+  if(n>x1)n=x1;
+
+  if(x<n)
+    d[x]*=FLOOR1_fromdB_LOOKUP[y];
+
+  while(++x<n){
     err=err+ady;
     if(err>=adx){
       err-=adx;
@@ -1068,7 +1072,7 @@ static int floor1_inverse2(vorbis_block 
 	hy*=info->mult;
 	hx=info->postlist[current];
 	
-	render_line(lx,hx,ly,hy,out);
+	render_line(n,lx,hx,ly,hy,out);
 	
 	lx=hx;
 	ly=hy;
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13150)
+++ lib/res0.c	(revision 13151)
@@ -375,59 +375,63 @@ static long **_01class(vorbis_block *vb,
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int n=info->end-info->begin;
+  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int n=end-info->begin;
   
-  int partvals=n/samples_per_partition;
-  long **partword=_vorbis_block_alloc(vb,ch*sizeof(*partword));
-  float scale=100./samples_per_partition;
-
-  /* we find the partition type for each partition of each
-     channel.  We'll go back and do the interleaved encoding in a
-     bit.  For now, clarity */
- 
-  for(i=0;i<ch;i++){
-    partword[i]=_vorbis_block_alloc(vb,n/samples_per_partition*sizeof(*partword[i]));
-    memset(partword[i],0,n/samples_per_partition*sizeof(*partword[i]));
-  }
-  
-  for(i=0;i<partvals;i++){
-    int offset=i*samples_per_partition+info->begin;
-    for(j=0;j<ch;j++){
-      float max=0.;
-      float ent=0.;
-      for(k=0;k<samples_per_partition;k++){
-	if(fabs(in[j][offset+k])>max)max=fabs(in[j][offset+k]);
-	ent+=fabs(rint(in[j][offset+k]));
+  if(n>0){
+    int partvals=n/samples_per_partition;
+    long **partword=_vorbis_block_alloc(vb,ch*sizeof(*partword));
+    float scale=100./samples_per_partition;
+    
+    /* we find the partition type for each partition of each
+       channel.  We'll go back and do the interleaved encoding in a
+       bit.  For now, clarity */
+    
+    for(i=0;i<ch;i++){
+      partword[i]=_vorbis_block_alloc(vb,n/samples_per_partition*sizeof(*partword[i]));
+      memset(partword[i],0,n/samples_per_partition*sizeof(*partword[i]));
+    }
+    
+    for(i=0;i<partvals;i++){
+      int offset=i*samples_per_partition+info->begin;
+      for(j=0;j<ch;j++){
+	float max=0.;
+	float ent=0.;
+	for(k=0;k<samples_per_partition;k++){
+	  if(fabs(in[j][offset+k])>max)max=fabs(in[j][offset+k]);
+	  ent+=fabs(rint(in[j][offset+k]));
+	}
+	ent*=scale;
+	
+	for(k=0;k<possible_partitions-1;k++)
+	  if(max<=info->classmetric1[k] &&
+	     (info->classmetric2[k]<0 || (int)ent<info->classmetric2[k]))
+	    break;
+	
+	partword[j][i]=k;  
       }
-      ent*=scale;
-      
-      for(k=0;k<possible_partitions-1;k++)
-	if(max<=info->classmetric1[k] &&
-	   (info->classmetric2[k]<0 || (int)ent<info->classmetric2[k]))
-	  break;
-      
-      partword[j][i]=k;  
     }
-  }
-
+    
 #ifdef TRAIN_RESAUX
-  {
-    FILE *of;
-    char buffer[80];
-  
-    for(i=0;i<ch;i++){
-      sprintf(buffer,"resaux_%d.vqd",look->train_seq);
-      of=fopen(buffer,"a");
-      for(j=0;j<partvals;j++)
-	fprintf(of,"%ld, ",partword[i][j]);
-      fprintf(of,"\n");
-      fclose(of);
+    {
+      FILE *of;
+      char buffer[80];
+      
+      for(i=0;i<ch;i++){
+	sprintf(buffer,"resaux_%d.vqd",look->train_seq);
+	of=fopen(buffer,"a");
+	for(j=0;j<partvals;j++)
+	  fprintf(of,"%ld, ",partword[i][j]);
+	fprintf(of,"\n");
+	fclose(of);
+      }
     }
-  }
 #endif
-  look->frames++;
-
-  return(partword);
+    look->frames++;
+    
+    return(partword);
+  }else
+    return(0);
 }
 
 /* designed for stereo or other modes where the partition size is an
@@ -442,50 +446,54 @@ static long **_2class(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int n=info->end-info->begin;
-
-  int partvals=n/samples_per_partition;
-  long **partword=_vorbis_block_alloc(vb,sizeof(*partword));
+  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int n=end-info->begin;
 
+  if(n>0){
+    int partvals=n/samples_per_partition;
+    long **partword=_vorbis_block_alloc(vb,sizeof(*partword));
+    
 #if defined(TRAIN_RES) || defined (TRAIN_RESAUX)
-  FILE *of;
-  char buffer[80];
+    FILE *of;
+    char buffer[80];
 #endif
-  
-  partword[0]=_vorbis_block_alloc(vb,n*ch/samples_per_partition*sizeof(*partword[0]));
-  memset(partword[0],0,n*ch/samples_per_partition*sizeof(*partword[0]));
-
-  for(i=0,l=info->begin/ch;i<partvals;i++){
-    float magmax=0.f;
-    float angmax=0.f;
-    for(j=0;j<samples_per_partition;j+=ch){
-      if(fabs(in[0][l])>magmax)magmax=fabs(in[0][l]);
-      for(k=1;k<ch;k++)
-	if(fabs(in[k][l])>angmax)angmax=fabs(in[k][l]);
-      l++;
-    }
-
-    for(j=0;j<possible_partitions-1;j++)
-      if(magmax<=info->classmetric1[j] &&
-	 angmax<=info->classmetric2[j])
-	break;
-
-    partword[0][i]=j;
-
-  }  
-  
+    
+    partword[0]=_vorbis_block_alloc(vb,n*ch/samples_per_partition*sizeof(*partword[0]));
+    memset(partword[0],0,n*ch/samples_per_partition*sizeof(*partword[0]));
+    
+    for(i=0,l=info->begin/ch;i<partvals;i++){
+      float magmax=0.f;
+      float angmax=0.f;
+      for(j=0;j<samples_per_partition;j+=ch){
+	if(fabs(in[0][l])>magmax)magmax=fabs(in[0][l]);
+	for(k=1;k<ch;k++)
+	  if(fabs(in[k][l])>angmax)angmax=fabs(in[k][l]);
+	l++;
+      }
+      
+      for(j=0;j<possible_partitions-1;j++)
+	if(magmax<=info->classmetric1[j] &&
+	   angmax<=info->classmetric2[j])
+	  break;
+      
+      partword[0][i]=j;
+      
+    }  
+    
 #ifdef TRAIN_RESAUX
-  sprintf(buffer,"resaux_%d.vqd",look->train_seq);
-  of=fopen(buffer,"a");
-  for(i=0;i<partvals;i++)
-    fprintf(of,"%ld, ",partword[0][i]);
-  fprintf(of,"\n");
-  fclose(of);
+    sprintf(buffer,"resaux_%d.vqd",look->train_seq);
+    of=fopen(buffer,"a");
+    for(i=0;i<partvals;i++)
+      fprintf(of,"%ld, ",partword[0][i]);
+    fprintf(of,"\n");
+    fclose(of);
 #endif
-
-  look->frames++;
-
-  return(partword);
+    
+    look->frames++;
+    
+    return(partword);
+  }else
+    return(0);
 }
 
 static int _01forward(oggpack_buffer *opb,
@@ -504,103 +512,106 @@ static int _01forward(oggpack_buffer *op
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
   int partitions_per_word=look->phrasebook->dim;
-  int n=info->end-info->begin;
-
-  int partvals=n/samples_per_partition;
-  long resbits[128];
-  long resvals[128];
+  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int n=end-info->begin;
 
+  if(n>0){
+    int partvals=n/samples_per_partition;
+    long resbits[128];
+    long resvals[128];
+    
 #ifdef TRAIN_RES
-  for(i=0;i<ch;i++)
-    for(j=info->begin;j<info->end;j++){
-      if(in[i][j]>look->tmax)look->tmax=in[i][j];
-      if(in[i][j]<look->tmin)look->tmin=in[i][j];
-    }
+    for(i=0;i<ch;i++)
+      for(j=info->begin;j<end;j++){
+	if(in[i][j]>look->tmax)look->tmax=in[i][j];
+	if(in[i][j]<look->tmin)look->tmin=in[i][j];
+      }
 #endif
-
-  memset(resbits,0,sizeof(resbits));
-  memset(resvals,0,sizeof(resvals));
-  
-  /* we code the partition words for each channel, then the residual
-     words for a partition per channel until we've written all the
-     residual words for that partition word.  Then write the next
-     partition channel words... */
-
-  for(s=0;s<look->stages;s++){
-
-    for(i=0;i<partvals;){
-
-      /* first we encode a partition codeword for each channel */
-      if(s==0){
-	for(j=0;j<ch;j++){
-	  long val=partword[j][i];
-	  for(k=1;k<partitions_per_word;k++){
-	    val*=possible_partitions;
-	    if(i+k<partvals)
-	      val+=partword[j][i+k];
-	  }	
-
-	  /* training hack */
-	  if(val<look->phrasebook->entries)
-	    look->phrasebits+=vorbis_book_encode(look->phrasebook,val,opb);
+    
+    memset(resbits,0,sizeof(resbits));
+    memset(resvals,0,sizeof(resvals));
+    
+    /* we code the partition words for each channel, then the residual
+       words for a partition per channel until we've written all the
+       residual words for that partition word.  Then write the next
+       partition channel words... */
+    
+    for(s=0;s<look->stages;s++){
+      
+      for(i=0;i<partvals;){
+	
+	/* first we encode a partition codeword for each channel */
+	if(s==0){
+	  for(j=0;j<ch;j++){
+	    long val=partword[j][i];
+	    for(k=1;k<partitions_per_word;k++){
+	      val*=possible_partitions;
+	      if(i+k<partvals)
+		val+=partword[j][i+k];
+	    }	
+	    
+	    /* training hack */
+	    if(val<look->phrasebook->entries)
+	      look->phrasebits+=vorbis_book_encode(look->phrasebook,val,opb);
 #if 0 /*def TRAIN_RES*/
-	  else
-	    fprintf(stderr,"!");
+	    else
+	      fprintf(stderr,"!");
 #endif
-	
+	    
+	  }
 	}
-      }
-      
-      /* now we encode interleaved residual values for the partitions */
-      for(k=0;k<partitions_per_word && i<partvals;k++,i++){
-	long offset=i*samples_per_partition+info->begin;
 	
-	for(j=0;j<ch;j++){
-	  if(s==0)resvals[partword[j][i]]+=samples_per_partition;
-	  if(info->secondstages[partword[j][i]]&(1<<s)){
-	    codebook *statebook=look->partbooks[partword[j][i]][s];
-	    if(statebook){
-	      int ret;
-	      long *accumulator=NULL;
-
+	/* now we encode interleaved residual values for the partitions */
+	for(k=0;k<partitions_per_word && i<partvals;k++,i++){
+	  long offset=i*samples_per_partition+info->begin;
+	  
+	  for(j=0;j<ch;j++){
+	    if(s==0)resvals[partword[j][i]]+=samples_per_partition;
+	    if(info->secondstages[partword[j][i]]&(1<<s)){
+	      codebook *statebook=look->partbooks[partword[j][i]][s];
+	      if(statebook){
+		int ret;
+		long *accumulator=NULL;
+		
 #ifdef TRAIN_RES
-	      accumulator=look->training_data[s][partword[j][i]];
-	      {
-		int l;
-		float *samples=in[j]+offset;
-		for(l=0;l<samples_per_partition;l++){
-		  if(samples[l]<look->training_min[s][partword[j][i]])
-		    look->training_min[s][partword[j][i]]=samples[l];
-		  if(samples[l]>look->training_max[s][partword[j][i]])
-		    look->training_max[s][partword[j][i]]=samples[l];
+		accumulator=look->training_data[s][partword[j][i]];
+		{
+		  int l;
+		  float *samples=in[j]+offset;
+		  for(l=0;l<samples_per_partition;l++){
+		    if(samples[l]<look->training_min[s][partword[j][i]])
+		      look->training_min[s][partword[j][i]]=samples[l];
+		    if(samples[l]>look->training_max[s][partword[j][i]])
+		      look->training_max[s][partword[j][i]]=samples[l];
+		  }
 		}
-	      }
 #endif
-	      
-	      ret=encode(opb,in[j]+offset,samples_per_partition,
-			 statebook,accumulator);
-
-	      look->postbits+=ret;
-	      resbits[partword[j][i]]+=ret;
+		
+		ret=encode(opb,in[j]+offset,samples_per_partition,
+			   statebook,accumulator);
+		
+		look->postbits+=ret;
+		resbits[partword[j][i]]+=ret;
+	      }
 	    }
 	  }
 	}
       }
     }
-  }
-
+    
   /*{
     long total=0;
     long totalbits=0;
     fprintf(stderr,"%d :: ",vb->mode);
     for(k=0;k<possible_partitions;k++){
-      fprintf(stderr,"%ld/%1.2g, ",resvals[k],(float)resbits[k]/resvals[k]);
-      total+=resvals[k];
-      totalbits+=resbits[k];
-      }
+    fprintf(stderr,"%ld/%1.2g, ",resvals[k],(float)resbits[k]/resvals[k]);
+    total+=resvals[k];
+    totalbits+=resbits[k];
+    }
     
     fprintf(stderr,":: %ld:%1.2g\n",total,(double)totalbits/total);
     }*/
+  }
   return(0);
 }
 
@@ -617,45 +628,48 @@ static int _01inverse(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int n=info->end-info->begin;
+  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int n=end-info->begin;
   
-  int partvals=n/samples_per_partition;
-  int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
-  int ***partword=alloca(ch*sizeof(*partword));
-
-  for(j=0;j<ch;j++)
-    partword[j]=_vorbis_block_alloc(vb,partwords*sizeof(*partword[j]));
-
-  for(s=0;s<look->stages;s++){
-
-    /* each loop decodes on partition codeword containing 
-       partitions_pre_word partitions */
-    for(i=0,l=0;i<partvals;l++){
-      if(s==0){
-	/* fetch the partition word for each channel */
-	for(j=0;j<ch;j++){
-	  int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-	  if(temp==-1)goto eopbreak;
-	  partword[j][l]=look->decodemap[temp];
-	  if(partword[j][l]==NULL)goto errout;
-	}
-      }
+  if(n>0){
+    int partvals=n/samples_per_partition;
+    int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
+    int ***partword=alloca(ch*sizeof(*partword));
+    
+    for(j=0;j<ch;j++)
+      partword[j]=_vorbis_block_alloc(vb,partwords*sizeof(*partword[j]));
+    
+    for(s=0;s<look->stages;s++){
       
-      /* now we decode residual values for the partitions */
-      for(k=0;k<partitions_per_word && i<partvals;k++,i++)
-	for(j=0;j<ch;j++){
-	  long offset=info->begin+i*samples_per_partition;
-	  if(info->secondstages[partword[j][l][k]]&(1<<s)){
-	    codebook *stagebook=look->partbooks[partword[j][l][k]][s];
-	    if(stagebook){
-	      if(decodepart(stagebook,in[j]+offset,&vb->opb,
-			    samples_per_partition)==-1)goto eopbreak;
-	    }
+      /* each loop decodes on partition codeword containing 
+	 partitions_per_word partitions */
+      for(i=0,l=0;i<partvals;l++){
+	if(s==0){
+	  /* fetch the partition word for each channel */
+	  for(j=0;j<ch;j++){
+	    int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
+	    
+	    if(temp==-1)goto eopbreak;
+	    partword[j][l]=look->decodemap[temp];
+	    if(partword[j][l]==NULL)goto errout;
 	  }
 	}
-    } 
+	
+	/* now we decode residual values for the partitions */
+	for(k=0;k<partitions_per_word && i<partvals;k++,i++)
+	  for(j=0;j<ch;j++){
+	    long offset=info->begin+i*samples_per_partition;
+	    if(info->secondstages[partword[j][l][k]]&(1<<s)){
+	      codebook *stagebook=look->partbooks[partword[j][l][k]][s];
+	      if(stagebook){
+		if(decodepart(stagebook,in[j]+offset,&vb->opb,
+			      samples_per_partition)==-1)goto eopbreak;
+	      }
+	    }
+	  }
+      } 
+    }
   }
-  
  errout:
  eopbreak:
   return(0);
@@ -833,41 +847,44 @@ int res2_inverse(vorbis_block *vb,vorbis
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int n=info->end-info->begin;
+  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int n=end-info->begin;
 
-  int partvals=n/samples_per_partition;
-  int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
-  int **partword=_vorbis_block_alloc(vb,partwords*sizeof(*partword));
-
-  for(i=0;i<ch;i++)if(nonzero[i])break;
-  if(i==ch)return(0); /* no nonzero vectors */
-
-  for(s=0;s<look->stages;s++){
-    for(i=0,l=0;i<partvals;l++){
-
-      if(s==0){
-	/* fetch the partition word */
-	int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-	if(temp==-1)goto eopbreak;
-	partword[l]=look->decodemap[temp];
-	if(partword[l]==NULL)goto errout;
-      }
-
-      /* now we decode residual values for the partitions */
-      for(k=0;k<partitions_per_word && i<partvals;k++,i++)
-	if(info->secondstages[partword[l][k]]&(1<<s)){
-	  codebook *stagebook=look->partbooks[partword[l][k]][s];
-	  
-	  if(stagebook){
-	    if(vorbis_book_decodevv_add(stagebook,in,
-					i*samples_per_partition+info->begin,ch,
-					&vb->opb,samples_per_partition)==-1)
-	      goto eopbreak;
-	  }
+  if(n>0){
+    int partvals=n/samples_per_partition;
+    int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
+    int **partword=_vorbis_block_alloc(vb,partwords*sizeof(*partword));
+    
+    
+    for(i=0;i<ch;i++)if(nonzero[i])break;
+    if(i==ch)return(0); /* no nonzero vectors */
+    
+    for(s=0;s<look->stages;s++){
+      for(i=0,l=0;i<partvals;l++){
+	
+	if(s==0){
+	  /* fetch the partition word */
+	  int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
+	  if(temp==-1)goto eopbreak;
+	  partword[l]=look->decodemap[temp];
+	  if(partword[l]==NULL)goto errout;
 	}
-    } 
+	
+	/* now we decode residual values for the partitions */
+	for(k=0;k<partitions_per_word && i<partvals;k++,i++)
+	  if(info->secondstages[partword[l][k]]&(1<<s)){
+	    codebook *stagebook=look->partbooks[partword[l][k]][s];
+	    
+	    if(stagebook){
+	      if(vorbis_book_decodevv_add(stagebook,in,
+					  i*samples_per_partition+info->begin,ch,
+					  &vb->opb,samples_per_partition)==-1)
+		goto eopbreak;
+	    }
+	  }
+      } 
+    }
   }
-  
  errout:
  eopbreak:
   return(0);

r13153.patch:
 res0.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

--- NEW FILE r13153.patch ---
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13152)
+++ lib/res0.c	(revision 13153)
@@ -375,7 +375,7 @@ static long **_01class(vorbis_block *vb,
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
   int n=end-info->begin;
   
   if(n>0){
@@ -446,7 +446,7 @@ static long **_2class(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
   int n=end-info->begin;
 
   if(n>0){
@@ -512,7 +512,7 @@ static int _01forward(oggpack_buffer *op
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
   int n=end-info->begin;
 
   if(n>0){
@@ -628,7 +628,7 @@ static int _01inverse(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
   int n=end-info->begin;
   
   if(n>0){
@@ -847,7 +847,7 @@ int res2_inverse(vorbis_block *vb,vorbis
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend?info->end:vb->pcmend);
+  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
   int n=end-info->begin;
 
   if(n>0){

r13154.patch:
 res0.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

--- NEW FILE r13154.patch ---
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13153)
+++ lib/res0.c	(revision 13154)
@@ -847,15 +847,15 @@ int res2_inverse(vorbis_block *vb,vorbis
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
-  int n=end-info->begin;
+  int max=(vb->pcmend*ch)>>1;
+  int end=(info->end<max?info->end:max);
+  int n=info->end-info->begin;
 
   if(n>0){
     int partvals=n/samples_per_partition;
     int partwords=(partvals+partitions_per_word-1)/partitions_per_word;
     int **partword=_vorbis_block_alloc(vb,partwords*sizeof(*partword));
     
-    
     for(i=0;i<ch;i++)if(nonzero[i])break;
     if(i==ch)return(0); /* no nonzero vectors */
     

r13155.patch:
 res0.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE r13155.patch ---
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13154)
+++ lib/res0.c	(revision 13155)
@@ -849,7 +849,7 @@ int res2_inverse(vorbis_block *vb,vorbis
   int partitions_per_word=look->phrasebook->dim;
   int max=(vb->pcmend*ch)>>1;
   int end=(info->end<max?info->end:max);
-  int n=info->end-info->begin;
+  int n=end-info->begin;
 
   if(n>0){
     int partvals=n/samples_per_partition;

r13160-CVE-2007-3106.patch:
 info.c |   21 +++++++++++++++------
 1 files changed, 15 insertions(+), 6 deletions(-)

--- NEW FILE r13160-CVE-2007-3106.patch ---
Index: lib/info.c
===================================================================
--- lib/info.c	(revision 13159)
+++ lib/info.c	(revision 13160)
@@ -139,7 +139,7 @@ void vorbis_comment_clear(vorbis_comment
   memset(vc,0,sizeof(*vc));
 }
 
-/* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
+/* blocksize 0 is guaranteed to be short, 1 is guaranteed to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = vi->codec_setup;
@@ -162,14 +162,23 @@ void vorbis_info_clear(vorbis_info *vi){
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);
 
     for(i=0;i<ci->maps;i++) /* unpack does the range checking */
-      _mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);
+      if(ci->map_param[i]) /* this may be cleaning up an aborted
+			      unpack, in which case the below type
+			      cannot be trusted */
+	_mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);
 
     for(i=0;i<ci->floors;i++) /* unpack does the range checking */
-      _floor_P[ci->floor_type[i]]->free_info(ci->floor_param[i]);
+      if(ci->floor_param[i]) /* this may be cleaning up an aborted
+				unpack, in which case the below type
+				cannot be trusted */
+	_floor_P[ci->floor_type[i]]->free_info(ci->floor_param[i]);
     
     for(i=0;i<ci->residues;i++) /* unpack does the range checking */
-      _residue_P[ci->residue_type[i]]->free_info(ci->residue_param[i]);
-
+      if(ci->residue_param[i]) /* this may be cleaning up an aborted
+				  unpack, in which case the below type
+				  cannot be trusted */
+	_residue_P[ci->residue_type[i]]->free_info(ci->residue_param[i]);
+    
     for(i=0;i<ci->books;i++){
       if(ci->book_param[i]){
 	/* knows if the book was not alloced */
@@ -416,7 +425,7 @@ static int _vorbis_pack_info(oggpack_buf
 }
 
 static int _vorbis_pack_comment(oggpack_buffer *opb,vorbis_comment *vc){
-  char temp[]="Xiph.Org libVorbis I 20050304";
+  char temp[]="Xiph.Org libVorbis I 20070621";
   int bytes = strlen(temp);
 
   /* preamble */  

r13162.patch:
 block.c      |   24 ++++++++++++++----------
 info.c       |   16 +++++++++-------
 psy.c        |    5 ++++-
 vorbisfile.c |    6 +++---
 4 files changed, 30 insertions(+), 21 deletions(-)

--- NEW FILE r13162.patch ---
Index: lib/psy.c
===================================================================
--- lib/psy.c	(revision 13161)
+++ lib/psy.c	(revision 13162)
@@ -553,7 +553,10 @@ static void bark_noise_hybridmp(int n,co
   int i;
 
   int lo, hi;
-  float R, A, B, D;
+  float R=0.f;
+  float A=0.f;
+  float B=0.f;
+  float D=1.f;
   float w, x, y;
 
   tN = tX = tXX = tY = tXY = 0.f;
Index: lib/info.c
===================================================================
--- lib/info.c	(revision 13161)
+++ lib/info.c	(revision 13162)
@@ -135,8 +135,8 @@ void vorbis_comment_clear(vorbis_comment
     if(vc->user_comments)_ogg_free(vc->user_comments);
 	if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guaranteed to be long.
@@ -600,12 +600,14 @@ int vorbis_analysis_headerout(vorbis_dsp
   memset(op_comm,0,sizeof(*op_comm));
   memset(op_code,0,sizeof(*op_code));
 
-  if(b->header)_ogg_free(b->header);
-  if(b->header1)_ogg_free(b->header1);
-  if(b->header2)_ogg_free(b->header2);
-  b->header=NULL;
-  b->header1=NULL;
-  b->header2=NULL;
+  if(b){
+    if(b->header)_ogg_free(b->header);
+    if(b->header1)_ogg_free(b->header1);
+    if(b->header2)_ogg_free(b->header2);
+    b->header=NULL;
+    b->header1=NULL;
+    b->header2=NULL;
+  }
   return(ret);
 }
 
Index: lib/vorbisfile.c
===================================================================
--- lib/vorbisfile.c	(revision 13161)
+++ lib/vorbisfile.c	(revision 13162)
@@ -986,8 +986,8 @@ int ov_raw_seek(OggVorbis_File *vf,ogg_i
     ogg_packet op;
     int lastblock=0;
     int accblock=0;
-    int thisblock;
-    int eosflag;
+    int thisblock=0;
+    int eosflag=0; 
 
     ogg_stream_init(&work_os,vf->current_serialno); /* get the memory ready */
     ogg_stream_reset(&work_os); /* eliminate the spurious OV_HOLE
@@ -1009,7 +1009,7 @@ int ov_raw_seek(OggVorbis_File *vf,ogg_i
 	    }else{
 	      
 	      if(eosflag)
-	      ogg_stream_packetout(&vf->os,NULL);
+		ogg_stream_packetout(&vf->os,NULL);
 	      else
 		if(lastblock)accblock+=(lastblock+thisblock)>>2;
 	    }	    
Index: lib/block.c
===================================================================
--- lib/block.c	(revision 13161)
+++ lib/block.c	(revision 13162)
@@ -326,20 +326,23 @@ void vorbis_dsp_clear(vorbis_dsp_state *
       }
 
       if(b->flr){
-	for(i=0;i<ci->floors;i++)
-	  _floor_P[ci->floor_type[i]]->
-	    free_look(b->flr[i]);
+	if(ci)
+	  for(i=0;i<ci->floors;i++)
+	    _floor_P[ci->floor_type[i]]->
+	      free_look(b->flr[i]);
 	_ogg_free(b->flr);
       }
       if(b->residue){
-	for(i=0;i<ci->residues;i++)
-	  _residue_P[ci->residue_type[i]]->
-	    free_look(b->residue[i]);
+	if(ci)
+	  for(i=0;i<ci->residues;i++)
+	    _residue_P[ci->residue_type[i]]->
+	      free_look(b->residue[i]);
 	_ogg_free(b->residue);
       }
       if(b->psy){
-	for(i=0;i<ci->psys;i++)
-	  _vp_psy_clear(b->psy+i);
+	if(ci)
+	  for(i=0;i<ci->psys;i++)
+	    _vp_psy_clear(b->psy+i);
 	_ogg_free(b->psy);
       }
 
@@ -352,8 +355,9 @@ void vorbis_dsp_clear(vorbis_dsp_state *
     }
     
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-	if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if(vi)
+	for(i=0;i<vi->channels;i++)
+	  if(v->pcm[i])_ogg_free(v->pcm[i]);
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }

r13167.patch:
 res0.c |  317 +++++++++++++++++++++++++++++++----------------------------------
 1 files changed, 154 insertions(+), 163 deletions(-)

--- NEW FILE r13167.patch ---
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13166)
+++ lib/res0.c	(revision 13167)
@@ -375,63 +375,59 @@ static long **_01class(vorbis_block *vb,
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
-  int n=end-info->begin;
+  int n=info->end-info->begin;
   
-  if(n>0){
-    int partvals=n/samples_per_partition;
-    long **partword=_vorbis_block_alloc(vb,ch*sizeof(*partword));
-    float scale=100./samples_per_partition;
-    
-    /* we find the partition type for each partition of each
-       channel.  We'll go back and do the interleaved encoding in a
-       bit.  For now, clarity */
-    
-    for(i=0;i<ch;i++){
-      partword[i]=_vorbis_block_alloc(vb,n/samples_per_partition*sizeof(*partword[i]));
-      memset(partword[i],0,n/samples_per_partition*sizeof(*partword[i]));
-    }
-    
-    for(i=0;i<partvals;i++){
-      int offset=i*samples_per_partition+info->begin;
-      for(j=0;j<ch;j++){
-	float max=0.;
-	float ent=0.;
-	for(k=0;k<samples_per_partition;k++){
-	  if(fabs(in[j][offset+k])>max)max=fabs(in[j][offset+k]);
-	  ent+=fabs(rint(in[j][offset+k]));
-	}
-	ent*=scale;
-	
-	for(k=0;k<possible_partitions-1;k++)
-	  if(max<=info->classmetric1[k] &&
-	     (info->classmetric2[k]<0 || (int)ent<info->classmetric2[k]))
-	    break;
-	
-	partword[j][i]=k;  
+  int partvals=n/samples_per_partition;
+  long **partword=_vorbis_block_alloc(vb,ch*sizeof(*partword));
+  float scale=100./samples_per_partition;
+  
+  /* we find the partition type for each partition of each
+     channel.  We'll go back and do the interleaved encoding in a
+     bit.  For now, clarity */
+  
+  for(i=0;i<ch;i++){
+    partword[i]=_vorbis_block_alloc(vb,n/samples_per_partition*sizeof(*partword[i]));
+    memset(partword[i],0,n/samples_per_partition*sizeof(*partword[i]));
+  }
+  
+  for(i=0;i<partvals;i++){
+    int offset=i*samples_per_partition+info->begin;
+    for(j=0;j<ch;j++){
+      float max=0.;
+      float ent=0.;
+      for(k=0;k<samples_per_partition;k++){
+	if(fabs(in[j][offset+k])>max)max=fabs(in[j][offset+k]);
+	ent+=fabs(rint(in[j][offset+k]));
       }
+      ent*=scale;
+      
+      for(k=0;k<possible_partitions-1;k++)
+	if(max<=info->classmetric1[k] &&
+	   (info->classmetric2[k]<0 || (int)ent<info->classmetric2[k]))
+	  break;
+      
+      partword[j][i]=k;  
     }
-    
+  }
+  
 #ifdef TRAIN_RESAUX
-    {
-      FILE *of;
-      char buffer[80];
-      
-      for(i=0;i<ch;i++){
-	sprintf(buffer,"resaux_%d.vqd",look->train_seq);
-	of=fopen(buffer,"a");
-	for(j=0;j<partvals;j++)
-	  fprintf(of,"%ld, ",partword[i][j]);
-	fprintf(of,"\n");
-	fclose(of);
-      }
+  {
+    FILE *of;
+    char buffer[80];
+    
+    for(i=0;i<ch;i++){
+      sprintf(buffer,"resaux_%d.vqd",look->train_seq);
+      of=fopen(buffer,"a");
+      for(j=0;j<partvals;j++)
+	fprintf(of,"%ld, ",partword[i][j]);
+      fprintf(of,"\n");
+      fclose(of);
     }
+  }
 #endif
-    look->frames++;
-    
-    return(partword);
-  }else
-    return(0);
+  look->frames++;
+  
+  return(partword);
 }
 
 /* designed for stereo or other modes where the partition size is an
@@ -446,54 +442,50 @@ static long **_2class(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
-  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
-  int n=end-info->begin;
+  int n=info->end-info->begin;
 
-  if(n>0){
-    int partvals=n/samples_per_partition;
-    long **partword=_vorbis_block_alloc(vb,sizeof(*partword));
-    
+  int partvals=n/samples_per_partition;
+  long **partword=_vorbis_block_alloc(vb,sizeof(*partword));
+  
 #if defined(TRAIN_RES) || defined (TRAIN_RESAUX)
-    FILE *of;
-    char buffer[80];
+  FILE *of;
+  char buffer[80];
 #endif
+  
+  partword[0]=_vorbis_block_alloc(vb,n*ch/samples_per_partition*sizeof(*partword[0]));
+  memset(partword[0],0,n*ch/samples_per_partition*sizeof(*partword[0]));
+  
+  for(i=0,l=info->begin/ch;i<partvals;i++){
+    float magmax=0.f;
+    float angmax=0.f;
+    for(j=0;j<samples_per_partition;j+=ch){
+      if(fabs(in[0][l])>magmax)magmax=fabs(in[0][l]);
+      for(k=1;k<ch;k++)
+	if(fabs(in[k][l])>angmax)angmax=fabs(in[k][l]);
+	l++;
+    }
     
-    partword[0]=_vorbis_block_alloc(vb,n*ch/samples_per_partition*sizeof(*partword[0]));
-    memset(partword[0],0,n*ch/samples_per_partition*sizeof(*partword[0]));
+    for(j=0;j<possible_partitions-1;j++)
+      if(magmax<=info->classmetric1[j] &&
+	 angmax<=info->classmetric2[j])
+	break;
     
-    for(i=0,l=info->begin/ch;i<partvals;i++){
-      float magmax=0.f;
-      float angmax=0.f;
-      for(j=0;j<samples_per_partition;j+=ch){
-	if(fabs(in[0][l])>magmax)magmax=fabs(in[0][l]);
-	for(k=1;k<ch;k++)
-	  if(fabs(in[k][l])>angmax)angmax=fabs(in[k][l]);
-	l++;
-      }
-      
-      for(j=0;j<possible_partitions-1;j++)
-	if(magmax<=info->classmetric1[j] &&
-	   angmax<=info->classmetric2[j])
-	  break;
-      
-      partword[0][i]=j;
-      
-    }  
+    partword[0][i]=j;
     
+  }  
+  
 #ifdef TRAIN_RESAUX
-    sprintf(buffer,"resaux_%d.vqd",look->train_seq);
-    of=fopen(buffer,"a");
-    for(i=0;i<partvals;i++)
-      fprintf(of,"%ld, ",partword[0][i]);
-    fprintf(of,"\n");
-    fclose(of);
+  sprintf(buffer,"resaux_%d.vqd",look->train_seq);
+  of=fopen(buffer,"a");
+  for(i=0;i<partvals;i++)
+    fprintf(of,"%ld, ",partword[0][i]);
+  fprintf(of,"\n");
+  fclose(of);
 #endif
-    
-    look->frames++;
-    
-    return(partword);
-  }else
-    return(0);
+  
+  look->frames++;
+  
+  return(partword);
 }
 
 static int _01forward(oggpack_buffer *opb,
@@ -512,93 +504,91 @@ static int _01forward(oggpack_buffer *op
   int samples_per_partition=info->grouping;
   int possible_partitions=info->partitions;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
-  int n=end-info->begin;
+  int n=info->end-info->begin;
 
-  if(n>0){
-    int partvals=n/samples_per_partition;
-    long resbits[128];
-    long resvals[128];
-    
+  int partvals=n/samples_per_partition;
+  long resbits[128];
+  long resvals[128];
+  
 #ifdef TRAIN_RES
-    for(i=0;i<ch;i++)
-      for(j=info->begin;j<end;j++){
-	if(in[i][j]>look->tmax)look->tmax=in[i][j];
-	if(in[i][j]<look->tmin)look->tmin=in[i][j];
-      }
+  for(i=0;i<ch;i++)
+    for(j=info->begin;j<end;j++){
+      if(in[i][j]>look->tmax)look->tmax=in[i][j];
+      if(in[i][j]<look->tmin)look->tmin=in[i][j];
+    }
 #endif
+  
+  memset(resbits,0,sizeof(resbits));
+  memset(resvals,0,sizeof(resvals));
+  
+  /* we code the partition words for each channel, then the residual
+     words for a partition per channel until we've written all the
+     residual words for that partition word.  Then write the next
+     partition channel words... */
+  
+  for(s=0;s<look->stages;s++){
     
-    memset(resbits,0,sizeof(resbits));
-    memset(resvals,0,sizeof(resvals));
-    
-    /* we code the partition words for each channel, then the residual
-       words for a partition per channel until we've written all the
-       residual words for that partition word.  Then write the next
-       partition channel words... */
-    
-    for(s=0;s<look->stages;s++){
+    for(i=0;i<partvals;){
       
-      for(i=0;i<partvals;){
-	
-	/* first we encode a partition codeword for each channel */
-	if(s==0){
-	  for(j=0;j<ch;j++){
-	    long val=partword[j][i];
-	    for(k=1;k<partitions_per_word;k++){
-	      val*=possible_partitions;
-	      if(i+k<partvals)
-		val+=partword[j][i+k];
-	    }	
-	    
-	    /* training hack */
-	    if(val<look->phrasebook->entries)
-	      look->phrasebits+=vorbis_book_encode(look->phrasebook,val,opb);
+      /* first we encode a partition codeword for each channel */
+      if(s==0){
+	for(j=0;j<ch;j++){
+	  long val=partword[j][i];
+	  for(k=1;k<partitions_per_word;k++){
+	    val*=possible_partitions;
+	    if(i+k<partvals)
+	      val+=partword[j][i+k];
+	  }	
+	  
+	  /* training hack */
+	  if(val<look->phrasebook->entries)
+	    look->phrasebits+=vorbis_book_encode(look->phrasebook,val,opb);
 #if 0 /*def TRAIN_RES*/
-	    else
-	      fprintf(stderr,"!");
+	  else
+	    fprintf(stderr,"!");
 #endif
-	    
-	  }
+	  
 	}
-	
-	/* now we encode interleaved residual values for the partitions */
-	for(k=0;k<partitions_per_word && i<partvals;k++,i++){
-	  long offset=i*samples_per_partition+info->begin;
+      }
+      
+      /* now we encode interleaved residual values for the partitions */
+      for(k=0;k<partitions_per_word && i<partvals;k++,i++){
+	long offset=i*samples_per_partition+info->begin;
 	  
-	  for(j=0;j<ch;j++){
-	    if(s==0)resvals[partword[j][i]]+=samples_per_partition;
-	    if(info->secondstages[partword[j][i]]&(1<<s)){
-	      codebook *statebook=look->partbooks[partword[j][i]][s];
-	      if(statebook){
-		int ret;
-		long *accumulator=NULL;
-		
+	for(j=0;j<ch;j++){
+	  if(s==0)resvals[partword[j][i]]+=samples_per_partition;
+	  if(info->secondstages[partword[j][i]]&(1<<s)){
+	    codebook *statebook=look->partbooks[partword[j][i]][s];
+	    if(statebook){
+	      int ret;
+	      long *accumulator=NULL;
+	      
 #ifdef TRAIN_RES
-		accumulator=look->training_data[s][partword[j][i]];
-		{
-		  int l;
-		  float *samples=in[j]+offset;
-		  for(l=0;l<samples_per_partition;l++){
-		    if(samples[l]<look->training_min[s][partword[j][i]])
-		      look->training_min[s][partword[j][i]]=samples[l];
-		    if(samples[l]>look->training_max[s][partword[j][i]])
-		      look->training_max[s][partword[j][i]]=samples[l];
-		  }
+	      accumulator=look->training_data[s][partword[j][i]];
+	      {
+		int l;
+		float *samples=in[j]+offset;
+		for(l=0;l<samples_per_partition;l++){
+		  if(samples[l]<look->training_min[s][partword[j][i]])
+		    look->training_min[s][partword[j][i]]=samples[l];
+		  if(samples[l]>look->training_max[s][partword[j][i]])
+		    look->training_max[s][partword[j][i]]=samples[l];
 		}
-#endif
-		
-		ret=encode(opb,in[j]+offset,samples_per_partition,
-			   statebook,accumulator);
-		
-		look->postbits+=ret;
-		resbits[partword[j][i]]+=ret;
 	      }
+#endif
+	      
+	      ret=encode(opb,in[j]+offset,samples_per_partition,
+			 statebook,accumulator);
+	      
+	      look->postbits+=ret;
+	      resbits[partword[j][i]]+=ret;
 	    }
 	  }
 	}
       }
     }
-    
+  }
+  
   /*{
     long total=0;
     long totalbits=0;
@@ -611,7 +601,7 @@ static int _01forward(oggpack_buffer *op
     
     fprintf(stderr,":: %ld:%1.2g\n",total,(double)totalbits/total);
     }*/
-  }
+
   return(0);
 }
 
@@ -628,7 +618,8 @@ static int _01inverse(vorbis_block *vb,v
   /* move all this setup out later */
   int samples_per_partition=info->grouping;
   int partitions_per_word=look->phrasebook->dim;
-  int end=(info->end<vb->pcmend/2?info->end:vb->pcmend/2);
+  int max=vb->pcmend>>1;
+  int end=(info->end<max?info->end:max);
   int n=end-info->begin;
   
   if(n>0){

r13168.patch:
 psych_16.h |    7 +++++++
 psych_44.h |    0 
 setup_16.h |    2 +-
 setup_22.h |    2 +-
 4 files changed, 9 insertions(+), 2 deletions(-)

--- NEW FILE r13168.patch ---
Index: lib/modes/psych_16.h
===================================================================
--- lib/modes/psych_16.h	(revision 13167)
+++ lib/modes/psych_16.h	(revision 13168)
@@ -112,6 +112,13 @@ static noise3 _psy_noisebias_16[4]={
     {-30,-30,-30,-30,-26,-26,-26,-26,-26,-26,-26,-26,-26,-24,-20,-20,-20}}},
 };
 
+static noiseguard _psy_noiseguards_16[4]={
+  {10,10,-1},
+  {10,10,-1},
+  {20,20,-1},
+  {20,20,-1},
+};
+
 static double _noise_thresh_16[4]={ .3,.5,.5,.5 };
 
 static int _noise_start_16[3]={ 256,256,9999 };
Index: lib/modes/psych_44.h
===================================================================
--- lib/modes/psych_44.h	(revision 13167)
+++ lib/modes/psych_44.h	(revision 13168)
Index: lib/modes/setup_22.h
===================================================================
--- lib/modes/setup_22.h	(revision 13167)
+++ lib/modes/setup_22.h	(revision 13168)
@@ -44,7 +44,7 @@ ve_setup_data_template ve_setup_22_stere
   _vp_tonemask_adj_16,
   _vp_tonemask_adj_16,
 
-  _psy_noiseguards_8,
+  _psy_noiseguards_16,
   _psy_noisebias_16_impulse,
   _psy_noisebias_16_short,
   _psy_noisebias_16_short,
Index: lib/modes/setup_16.h
===================================================================
--- lib/modes/setup_16.h	(revision 13167)
+++ lib/modes/setup_16.h	(revision 13168)
@@ -65,7 +65,7 @@ ve_setup_data_template ve_setup_16_stere
   _vp_tonemask_adj_16,
   _vp_tonemask_adj_16,
 
-  _psy_noiseguards_8,
+  _psy_noiseguards_16,
   _psy_noisebias_16_impulse,
   _psy_noisebias_16_short,
   _psy_noisebias_16_short,

r13169.patch:
 codebook.c |    1 +
 info.c     |    2 +-
 res0.c     |    8 +++++---
 3 files changed, 7 insertions(+), 4 deletions(-)

--- NEW FILE r13169.patch ---
Index: lib/codebook.c
===================================================================
--- lib/codebook.c	(revision 13168)
+++ lib/codebook.c	(revision 13169)
@@ -255,6 +255,7 @@ int vorbis_staticbook_unpack(oggpack_buf
 
 /* returns the number of bits ************************************************/
 int vorbis_book_encode(codebook *book, int a, oggpack_buffer *b){
+  if(a<0 || a>=book->c->entries)return(0);
   oggpack_write(b,book->codelist[a],book->c->lengthlist[a]);
   return(book->c->lengthlist[a]);
 }
Index: lib/info.c
===================================================================
--- lib/info.c	(revision 13168)
+++ lib/info.c	(revision 13169)
@@ -425,7 +425,7 @@ static int _vorbis_pack_info(oggpack_buf
 }
 
 static int _vorbis_pack_comment(oggpack_buffer *opb,vorbis_comment *vc){
-  char temp[]="Xiph.Org libVorbis I 20070621";
+  char temp[]="Xiph.Org libVorbis I 20070622";
   int bytes = strlen(temp);
 
   /* preamble */  
Index: lib/res0.c
===================================================================
--- lib/res0.c	(revision 13168)
+++ lib/res0.c	(revision 13169)
@@ -336,7 +336,7 @@ static int local_book_besterror(codebook
     }
   }
 
-  {
+  if(best>-1){
     float *ptr=book->valuelist+best*dim;
     for(i=0;i<dim;i++)
       *a++ -= *ptr++;
@@ -355,10 +355,12 @@ static int _encodepart(oggpack_buffer *o
     int entry=local_book_besterror(book,vec+i*dim);
 
 #ifdef TRAIN_RES
-    acc[entry]++;
+    if(entry>0)
+      acc[entry]++;
 #endif
-
+      
     bits+=vorbis_book_encode(book,entry,opb);
+  
   }
 
   return(bits);

r13170.patch:
 books/coupled/res_books_stereo.h |  308 ---------------------------------------
 modes/residue_16.h               |    4 
 modes/residue_8.h                |   24 ++-
 3 files changed, 20 insertions(+), 316 deletions(-)

--- NEW FILE r13170.patch ---
Index: lib/modes/residue_16.h
===================================================================
--- lib/modes/residue_16.h	(revision 13169)
+++ lib/modes/residue_16.h	(revision 13170)
@@ -21,7 +21,7 @@ static static_bookblock _resbook_16s_0={
   {
     {0},
     {0,0,&_16c0_s_p1_0},
-    {0,0,&_16c0_s_p2_0},
+    {0},
     {0,0,&_16c0_s_p3_0},
     {0,0,&_16c0_s_p4_0},
     {0,0,&_16c0_s_p5_0},
@@ -35,7 +35,7 @@ static static_bookblock _resbook_16s_1={
   {
     {0},
     {0,0,&_16c1_s_p1_0},
-    {0,0,&_16c1_s_p2_0},
+    {0},
     {0,0,&_16c1_s_p3_0},
     {0,0,&_16c1_s_p4_0},
     {0,0,&_16c1_s_p5_0},
Index: lib/modes/residue_8.h
===================================================================
--- lib/modes/residue_8.h	(revision 13169)
+++ lib/modes/residue_8.h	(revision 13170)
@@ -22,17 +22,29 @@
 
 static static_bookblock _resbook_8s_0={
   {
-    {0},{0,0,&_8c0_s_p1_0},{0,0,&_8c0_s_p2_0},{0,0,&_8c0_s_p3_0},
-    {0,0,&_8c0_s_p4_0},{0,0,&_8c0_s_p5_0},{0,0,&_8c0_s_p6_0},
-    {&_8c0_s_p7_0,&_8c0_s_p7_1},{&_8c0_s_p8_0,&_8c0_s_p8_1},
+    {0},
+    {0,0,&_8c0_s_p1_0},
+    {0},
+    {0,0,&_8c0_s_p3_0},
+    {0,0,&_8c0_s_p4_0},
+    {0,0,&_8c0_s_p5_0},
+    {0,0,&_8c0_s_p6_0},
+    {&_8c0_s_p7_0,&_8c0_s_p7_1},
+    {&_8c0_s_p8_0,&_8c0_s_p8_1},
     {&_8c0_s_p9_0,&_8c0_s_p9_1,&_8c0_s_p9_2}
    }
 };
 static static_bookblock _resbook_8s_1={
   {
-    {0},{0,0,&_8c1_s_p1_0},{0,0,&_8c1_s_p2_0},{0,0,&_8c1_s_p3_0},
-    {0,0,&_8c1_s_p4_0},{0,0,&_8c1_s_p5_0},{0,0,&_8c1_s_p6_0},
-    {&_8c1_s_p7_0,&_8c1_s_p7_1},{&_8c1_s_p8_0,&_8c1_s_p8_1},
+    {0},
+    {0,0,&_8c1_s_p1_0},
+    {0},
+    {0,0,&_8c1_s_p3_0},
+    {0,0,&_8c1_s_p4_0},
+    {0,0,&_8c1_s_p5_0},
+    {0,0,&_8c1_s_p6_0},
+    {&_8c1_s_p7_0,&_8c1_s_p7_1},
+    {&_8c1_s_p8_0,&_8c1_s_p8_1},
     {&_8c1_s_p9_0,&_8c1_s_p9_1,&_8c1_s_p9_2}
    }
 };
Index: lib/books/coupled/res_books_stereo.h
===================================================================
--- lib/books/coupled/res_books_stereo.h	(revision 13169)
+++ lib/books/coupled/res_books_stereo.h	(revision 13170)
@@ -462,83 +462,6 @@ static static_codebook _16c0_s_p1_0 = {
 	0
 };
 
-static long _vq_quantlist__16c0_s_p2_0[] = {
-	2,
-	1,
-	3,
-	0,
-	4,
-};
-
-static long _vq_lengthlist__16c0_s_p2_0[] = {
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0,
-};
-
-static float _vq_quantthresh__16c0_s_p2_0[] = {
-	-1.5, -0.5, 0.5, 1.5, 
-};
-
-static long _vq_quantmap__16c0_s_p2_0[] = {
-	    3,    1,    0,    2,    4,
-};
-
-static encode_aux_threshmatch _vq_auxt__16c0_s_p2_0 = {
-	_vq_quantthresh__16c0_s_p2_0,
-	_vq_quantmap__16c0_s_p2_0,
-	5,
-	5
-};
-
-static static_codebook _16c0_s_p2_0 = {
-	4, 625,
-	_vq_lengthlist__16c0_s_p2_0,
-	1, -533725184, 1611661312, 3, 0,
-	_vq_quantlist__16c0_s_p2_0,
-	NULL,
-	&_vq_auxt__16c0_s_p2_0,
-	NULL,
-	0
-};
-
 static long _vq_quantlist__16c0_s_p3_0[] = {
 	2,
 	1,
@@ -1652,83 +1575,6 @@ static static_codebook _16c1_s_p1_0 = {
 	0
 };
 
-static long _vq_quantlist__16c1_s_p2_0[] = {
-	2,
-	1,
-	3,
-	0,
-	4,
-};
-
-static long _vq_lengthlist__16c1_s_p2_0[] = {
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0,
-};
-
-static float _vq_quantthresh__16c1_s_p2_0[] = {
-	-1.5, -0.5, 0.5, 1.5, 
-};
-
-static long _vq_quantmap__16c1_s_p2_0[] = {
-	    3,    1,    0,    2,    4,
-};
-
-static encode_aux_threshmatch _vq_auxt__16c1_s_p2_0 = {
-	_vq_quantthresh__16c1_s_p2_0,
-	_vq_quantmap__16c1_s_p2_0,
-	5,
-	5
-};
-
-static static_codebook _16c1_s_p2_0 = {
-	4, 625,
-	_vq_lengthlist__16c1_s_p2_0,
-	1, -533725184, 1611661312, 3, 0,
-	_vq_quantlist__16c1_s_p2_0,
-	NULL,
-	&_vq_auxt__16c1_s_p2_0,
-	NULL,
-	0
-};
-
 static long _vq_quantlist__16c1_s_p3_0[] = {
 	2,
 	1,
@@ -3764,83 +3610,6 @@ static static_codebook _8c0_s_p1_0 = {
 	0
 };
 
-static long _vq_quantlist__8c0_s_p2_0[] = {
-	2,
-	1,
-	3,
-	0,
-	4,
-};
-
-static long _vq_lengthlist__8c0_s_p2_0[] = {
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0,
-};
-
-static float _vq_quantthresh__8c0_s_p2_0[] = {
-	-1.5, -0.5, 0.5, 1.5, 
-};
-
-static long _vq_quantmap__8c0_s_p2_0[] = {
-	    3,    1,    0,    2,    4,
-};
-
-static encode_aux_threshmatch _vq_auxt__8c0_s_p2_0 = {
-	_vq_quantthresh__8c0_s_p2_0,
-	_vq_quantmap__8c0_s_p2_0,
-	5,
-	5
-};
-
-static static_codebook _8c0_s_p2_0 = {
-	4, 625,
-	_vq_lengthlist__8c0_s_p2_0,
-	1, -533725184, 1611661312, 3, 0,
-	_vq_quantlist__8c0_s_p2_0,
-	NULL,
-	&_vq_auxt__8c0_s_p2_0,
-	NULL,
-	0
-};
-
 static long _vq_quantlist__8c0_s_p3_0[] = {
 	2,
 	1,
@@ -4933,83 +4702,6 @@ static static_codebook _8c1_s_p1_0 = {
 	0
 };
 
-static long _vq_quantlist__8c1_s_p2_0[] = {
-	2,
-	1,
-	3,
-	0,
-	4,
-};
-
-static long _vq_lengthlist__8c1_s_p2_0[] = {
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	 0,
-};
-
-static float _vq_quantthresh__8c1_s_p2_0[] = {
-	-1.5, -0.5, 0.5, 1.5, 
-};
-
-static long _vq_quantmap__8c1_s_p2_0[] = {
-	    3,    1,    0,    2,    4,
-};
-
-static encode_aux_threshmatch _vq_auxt__8c1_s_p2_0 = {
-	_vq_quantthresh__8c1_s_p2_0,
-	_vq_quantmap__8c1_s_p2_0,
-	5,
-	5
-};
-
-static static_codebook _8c1_s_p2_0 = {
-	4, 625,
-	_vq_lengthlist__8c1_s_p2_0,
-	1, -533725184, 1611661312, 3, 0,
-	_vq_quantlist__8c1_s_p2_0,
-	NULL,
-	&_vq_auxt__8c1_s_p2_0,
-	NULL,
-	0
-};
-
 static long _vq_quantlist__8c1_s_p3_0[] = {
 	2,
 	1,

r13172.patch:
 codebook.c   |  172 ++++++++++++++++++++++++++++++++---------------------------
 sharedbook.c |  133 ++++++++++++++++++++++-----------------------
 2 files changed, 162 insertions(+), 143 deletions(-)

--- NEW FILE r13172.patch ---
Index: lib/codebook.c
===================================================================
--- lib/codebook.c	(revision 13171)
+++ lib/codebook.c	(revision 13172)
@@ -311,7 +311,7 @@ STIN long decode_packed_entry_number(cod
   int  read=book->dec_maxlength;
   long lo,hi;
   long lok = oggpack_look(b,book->dec_firsttablen);
- 
+  
   if (lok >= 0) {
     long entry = book->dec_firsttable[lok];
     if(entry&0x80000000UL){
@@ -325,24 +325,24 @@ STIN long decode_packed_entry_number(cod
     lo=0;
     hi=book->used_entries;
   }
-
+  
   lok = oggpack_look(b, read);
-
+  
   while(lok<0 && read>1)
     lok = oggpack_look(b, --read);
   if(lok<0)return -1;
-
+  
   /* bisect search for the codeword in the ordered list */
   {
     ogg_uint32_t testword=bitreverse((ogg_uint32_t)lok);
-
+    
     while(hi-lo>1){
       long p=(hi-lo)>>1;
       long test=book->codelist[lo+p]>testword;    
       lo+=p&(test-1);
       hi-=p&(-test);
-    }
-
+      }
+    
     if(book->dec_codelengths[lo]<=read){
       oggpack_adv(b, book->dec_codelengths[lo]);
       return(lo);
@@ -350,6 +350,7 @@ STIN long decode_packed_entry_number(cod
   }
   
   oggpack_adv(b, read);
+
   return(-1);
 }
 
@@ -369,104 +370,121 @@ STIN long decode_packed_entry_number(cod
 
 /* returns the [original, not compacted] entry number or -1 on eof *********/
 long vorbis_book_decode(codebook *book, oggpack_buffer *b){
-  long packed_entry=decode_packed_entry_number(book,b);
-  if(packed_entry>=0)
-    return(book->dec_index[packed_entry]);
-  
+  if(book->used_entries>0){
+    long packed_entry=decode_packed_entry_number(book,b);
+    if(packed_entry>=0)
+      return(book->dec_index[packed_entry]);
+  }
+
   /* if there's no dec_index, the codebook unpacking isn't collapsed */
-  return(packed_entry);
+  return(-1);
 }
 
 /* returns 0 on OK or -1 on eof *************************************/
 long vorbis_book_decodevs_add(codebook *book,float *a,oggpack_buffer *b,int n){
-  int step=n/book->dim;
-  long *entry = alloca(sizeof(*entry)*step);
-  float **t = alloca(sizeof(*t)*step);
-  int i,j,o;
-
-  for (i = 0; i < step; i++) {
-    entry[i]=decode_packed_entry_number(book,b);
-    if(entry[i]==-1)return(-1);
-    t[i] = book->valuelist+entry[i]*book->dim;
+  if(book->used_entries>0){
+    int step=n/book->dim;
+    long *entry = alloca(sizeof(*entry)*step);
+    float **t = alloca(sizeof(*t)*step);
+    int i,j,o;
+    
+    for (i = 0; i < step; i++) {
+      entry[i]=decode_packed_entry_number(book,b);
+      if(entry[i]==-1)return(-1);
+      t[i] = book->valuelist+entry[i]*book->dim;
+    }
+    for(i=0,o=0;i<book->dim;i++,o+=step)
+      for (j=0;j<step;j++)
+	a[o+j]+=t[j][i];
   }
-  for(i=0,o=0;i<book->dim;i++,o+=step)
-    for (j=0;j<step;j++)
-      a[o+j]+=t[j][i];
   return(0);
 }
 
 long vorbis_book_decodev_add(codebook *book,float *a,oggpack_buffer *b,int n){
-  int i,j,entry;
-  float *t;
+  if(book->used_entries>0){
+    int i,j,entry;
+    float *t;
+    
+    if(book->dim>8){
+      for(i=0;i<n;){
+	entry = decode_packed_entry_number(book,b);
+	if(entry==-1)return(-1);
+	t     = book->valuelist+entry*book->dim;
+	for (j=0;j<book->dim;)
+	  a[i++]+=t[j++];
+      }
+    }else{
+      for(i=0;i<n;){
+	entry = decode_packed_entry_number(book,b);
+	if(entry==-1)return(-1);
+	t     = book->valuelist+entry*book->dim;
+	j=0;
+	switch((int)book->dim){
+	case 8:
+	  a[i++]+=t[j++];
+	case 7:
+	  a[i++]+=t[j++];
+	case 6:
+	  a[i++]+=t[j++];
+	case 5:
+	  a[i++]+=t[j++];
+	case 4:
+	  a[i++]+=t[j++];
+	case 3:
+	  a[i++]+=t[j++];
+	case 2:
+	  a[i++]+=t[j++];
+	case 1:
+	  a[i++]+=t[j++];
+	case 0:
+	  break;
+	}
+      }
+    }    
+  }
+  return(0);
+}
 
-  if(book->dim>8){
+long vorbis_book_decodev_set(codebook *book,float *a,oggpack_buffer *b,int n){
+  if(book->used_entries>0){
+    int i,j,entry;
+    float *t;
+    
     for(i=0;i<n;){
       entry = decode_packed_entry_number(book,b);
       if(entry==-1)return(-1);
       t     = book->valuelist+entry*book->dim;
       for (j=0;j<book->dim;)
-	a[i++]+=t[j++];
+	a[i++]=t[j++];
     }
   }else{
+    int i,j;
+    
     for(i=0;i<n;){
-      entry = decode_packed_entry_number(book,b);
-      if(entry==-1)return(-1);
-      t     = book->valuelist+entry*book->dim;
-      j=0;
-      switch((int)book->dim){
-      case 8:
-	a[i++]+=t[j++];
-      case 7:
-	a[i++]+=t[j++];
-      case 6:
-	a[i++]+=t[j++];
-      case 5:
-	a[i++]+=t[j++];
-      case 4:
-	a[i++]+=t[j++];
-      case 3:
-	a[i++]+=t[j++];
-      case 2:
-	a[i++]+=t[j++];
-      case 1:
-	a[i++]+=t[j++];
-      case 0:
-	break;
-      }
+      for (j=0;j<book->dim;)
+	a[i++]=0.f;
     }
-  }    
-  return(0);
-}
-
-long vorbis_book_decodev_set(codebook *book,float *a,oggpack_buffer *b,int n){
-  int i,j,entry;
-  float *t;
-
-  for(i=0;i<n;){
-    entry = decode_packed_entry_number(book,b);
-    if(entry==-1)return(-1);
-    t     = book->valuelist+entry*book->dim;
-    for (j=0;j<book->dim;)
-      a[i++]=t[j++];
   }
   return(0);
 }
 
 long vorbis_book_decodevv_add(codebook *book,float **a,long offset,int ch,
 			      oggpack_buffer *b,int n){
+
   long i,j,entry;
   int chptr=0;
-
-  for(i=offset/ch;i<(offset+n)/ch;){
-    entry = decode_packed_entry_number(book,b);
-    if(entry==-1)return(-1);
-    {
-      const float *t = book->valuelist+entry*book->dim;
-      for (j=0;j<book->dim;j++){
-	a[chptr++][i]+=t[j];
-	if(chptr==ch){
-	  chptr=0;
-	  i++;
+  if(book->used_entries>0){
+    for(i=offset/ch;i<(offset+n)/ch;){
+      entry = decode_packed_entry_number(book,b);
+      if(entry==-1)return(-1);
+      {
+	const float *t = book->valuelist+entry*book->dim;
+	for (j=0;j<book->dim;j++){
+	  a[chptr++][i]+=t[j];
+	  if(chptr==ch){
+	    chptr=0;
+	    i++;
+	  }
 	}
       }
     }
Index: lib/sharedbook.c
===================================================================
--- lib/sharedbook.c	(revision 13171)
+++ lib/sharedbook.c	(revision 13172)
@@ -329,30 +329,31 @@ int vorbis_book_init_decode(codebook *c,
   c->used_entries=n;
   c->dim=s->dim;
 
-  /* two different remappings go on here.  
-
-     First, we collapse the likely sparse codebook down only to
-     actually represented values/words.  This collapsing needs to be
-     indexed as map-valueless books are used to encode original entry
-     positions as integers.
-
-     Second, we reorder all vectors, including the entry index above,
-     by sorted bitreversed codeword to allow treeless decode. */
+  if(n>0){
+    
+    /* two different remappings go on here.  
+       
+    First, we collapse the likely sparse codebook down only to
+    actually represented values/words.  This collapsing needs to be
+    indexed as map-valueless books are used to encode original entry
+    positions as integers.
+    
+    Second, we reorder all vectors, including the entry index above,
+    by sorted bitreversed codeword to allow treeless decode. */
 
-  {
     /* perform sort */
     ogg_uint32_t *codes=_make_words(s->lengthlist,s->entries,c->used_entries);
     ogg_uint32_t **codep=alloca(sizeof(*codep)*n);
     
     if(codes==NULL)goto err_out;
-
+    
     for(i=0;i<n;i++){
       codes[i]=bitreverse(codes[i]);
       codep[i]=codes+i;
     }
-
+    
     qsort(codep,n,sizeof(*codep),sort32a);
-
+    
     sortindex=alloca(n*sizeof(*sortindex));
     c->codelist=_ogg_malloc(n*sizeof(*c->codelist));
     /* the index is a reverse index */
@@ -364,66 +365,66 @@ int vorbis_book_init_decode(codebook *c,
     for(i=0;i<n;i++)
       c->codelist[sortindex[i]]=codes[i];
     _ogg_free(codes);
-  }
-
-  c->valuelist=_book_unquantize(s,n,sortindex);
-  c->dec_index=_ogg_malloc(n*sizeof(*c->dec_index));
-
-  for(n=0,i=0;i<s->entries;i++)
-    if(s->lengthlist[i]>0)
-      c->dec_index[sortindex[n++]]=i;
   
-  c->dec_codelengths=_ogg_malloc(n*sizeof(*c->dec_codelengths));
-  for(n=0,i=0;i<s->entries;i++)
-    if(s->lengthlist[i]>0)
-      c->dec_codelengths[sortindex[n++]]=s->lengthlist[i];
 
-  c->dec_firsttablen=_ilog(c->used_entries)-4; /* this is magic */
-  if(c->dec_firsttablen<5)c->dec_firsttablen=5;
-  if(c->dec_firsttablen>8)c->dec_firsttablen=8;
-
-  tabn=1<<c->dec_firsttablen;
-  c->dec_firsttable=_ogg_calloc(tabn,sizeof(*c->dec_firsttable));
-  c->dec_maxlength=0;
-
-  for(i=0;i<n;i++){
-    if(c->dec_maxlength<c->dec_codelengths[i])
-      c->dec_maxlength=c->dec_codelengths[i];
-    if(c->dec_codelengths[i]<=c->dec_firsttablen){
-      ogg_uint32_t orig=bitreverse(c->codelist[i]);
-      for(j=0;j<(1<<(c->dec_firsttablen-c->dec_codelengths[i]));j++)
-	c->dec_firsttable[orig|(j<<c->dec_codelengths[i])]=i+1;
+    c->valuelist=_book_unquantize(s,n,sortindex);
+    c->dec_index=_ogg_malloc(n*sizeof(*c->dec_index));
+    
+    for(n=0,i=0;i<s->entries;i++)
+      if(s->lengthlist[i]>0)
+	c->dec_index[sortindex[n++]]=i;
+    
+    c->dec_codelengths=_ogg_malloc(n*sizeof(*c->dec_codelengths));
+    for(n=0,i=0;i<s->entries;i++)
+      if(s->lengthlist[i]>0)
+	c->dec_codelengths[sortindex[n++]]=s->lengthlist[i];
+    
+    c->dec_firsttablen=_ilog(c->used_entries)-4; /* this is magic */
+    if(c->dec_firsttablen<5)c->dec_firsttablen=5;
+    if(c->dec_firsttablen>8)c->dec_firsttablen=8;
+    
+    tabn=1<<c->dec_firsttablen;
+    c->dec_firsttable=_ogg_calloc(tabn,sizeof(*c->dec_firsttable));
+    c->dec_maxlength=0;
+    
+    for(i=0;i<n;i++){
+      if(c->dec_maxlength<c->dec_codelengths[i])
+	c->dec_maxlength=c->dec_codelengths[i];
+      if(c->dec_codelengths[i]<=c->dec_firsttablen){
+	ogg_uint32_t orig=bitreverse(c->codelist[i]);
+	for(j=0;j<(1<<(c->dec_firsttablen-c->dec_codelengths[i]));j++)
+	  c->dec_firsttable[orig|(j<<c->dec_codelengths[i])]=i+1;
+      }
     }
-  }
-
-  /* now fill in 'unused' entries in the firsttable with hi/lo search
-     hints for the non-direct-hits */
-  {
-    ogg_uint32_t mask=0xfffffffeUL<<(31-c->dec_firsttablen);
-    long lo=0,hi=0;
-
-    for(i=0;i<tabn;i++){
-      ogg_uint32_t word=i<<(32-c->dec_firsttablen);
-      if(c->dec_firsttable[bitreverse(word)]==0){
-	while((lo+1)<n && c->codelist[lo+1]<=word)lo++;
-	while(    hi<n && word>=(c->codelist[hi]&mask))hi++;
-	
-	/* we only actually have 15 bits per hint to play with here.
-           In order to overflow gracefully (nothing breaks, efficiency
-           just drops), encode as the difference from the extremes. */
-	{
-	  unsigned long loval=lo;
-	  unsigned long hival=n-hi;
-
-	  if(loval>0x7fff)loval=0x7fff;
-	  if(hival>0x7fff)hival=0x7fff;
-	  c->dec_firsttable[bitreverse(word)]=
-	    0x80000000UL | (loval<<15) | hival;
+    
+    /* now fill in 'unused' entries in the firsttable with hi/lo search
+       hints for the non-direct-hits */
+    {
+      ogg_uint32_t mask=0xfffffffeUL<<(31-c->dec_firsttablen);
+      long lo=0,hi=0;
+      
+      for(i=0;i<tabn;i++){
+	ogg_uint32_t word=i<<(32-c->dec_firsttablen);
+	if(c->dec_firsttable[bitreverse(word)]==0){
+	  while((lo+1)<n && c->codelist[lo+1]<=word)lo++;
+	  while(    hi<n && word>=(c->codelist[hi]&mask))hi++;
+	  
+	  /* we only actually have 15 bits per hint to play with here.
+	     In order to overflow gracefully (nothing breaks, efficiency
+	     just drops), encode as the difference from the extremes. */
+	  {
+	    unsigned long loval=lo;
+	    unsigned long hival=n-hi;
+	    
+	    if(loval>0x7fff)loval=0x7fff;
+	    if(hival>0x7fff)hival=0x7fff;
+	    c->dec_firsttable[bitreverse(word)]=
+	      0x80000000UL | (loval<<15) | hival;
+	  }
 	}
       }
     }
   }
-  
 
   return(0);
  err_out:

r13179.patch:
 info.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

--- NEW FILE r13179.patch ---
Index: lib/info.c
===================================================================
--- lib/info.c	(revision 13178)
+++ lib/info.c	(revision 13179)
@@ -222,7 +222,8 @@ static int _vorbis_unpack_info(vorbis_in
   if(vi->channels<1)goto err_out;
   if(ci->blocksizes[0]<64)goto err_out; 
   if(ci->blocksizes[1]<ci->blocksizes[0])goto err_out;
-  
+  if(ci->blocksizes[1]>8192)goto err_out;
+
   if(oggpack_read(opb,1)!=1)goto err_out; /* EOP check */
 
   return(0);

r13211.patch:
 vorbisfile.c |  102 ++++++++++++++++++++++++++++++++++++++---------------------
 1 files changed, 66 insertions(+), 36 deletions(-)

--- NEW FILE r13211.patch ---
Index: lib/vorbisfile.c
===================================================================
--- lib/vorbisfile.c	(revision 13210)
+++ lib/vorbisfile.c	(revision 13211)
@@ -73,15 +73,17 @@ static long _get_data(OggVorbis_File *vf
 }
 
 /* save a tiny smidge of verbosity to make the code more readable */
-static void _seek_helper(OggVorbis_File *vf,ogg_int64_t offset){
+static int _seek_helper(OggVorbis_File *vf,ogg_int64_t offset){
   if(vf->datasource){ 
-    (vf->callbacks.seek_func)(vf->datasource, offset, SEEK_SET);
+    if((vf->callbacks.seek_func)(vf->datasource, offset, SEEK_SET) == -1)
+      return OV_EREAD;
     vf->offset=offset;
     ogg_sync_reset(&vf->oy);
   }else{
     /* shouldn't happen unless someone writes a broken callback */
-    return;
+    return OV_EFAULT;
   }
+  return 0;
 }
 
 /* The read/seek functions track absolute position within the stream */
@@ -145,7 +147,10 @@ static ogg_int64_t _get_prev_page(OggVor
     begin-=CHUNKSIZE;
     if(begin<0)
       begin=0;
-    _seek_helper(vf,begin);
+
+    ret=_seek_helper(vf,begin);
+    if(ret)return(ret);
+
     while(vf->offset<end){
       ret=_get_next_page(vf,og,end-vf->offset);
       if(ret==OV_EREAD)return(OV_EREAD);
@@ -158,7 +163,9 @@ static ogg_int64_t _get_prev_page(OggVor
   }
 
   /* we have the offset.  Actually snork and hold the page now */
-  _seek_helper(vf,offset);
+  ret=_seek_helper(vf,offset);
+  if(ret)return(ret);
+
   ret=_get_next_page(vf,og,CHUNKSIZE);
   if(ret<0)
     /* this shouldn't be possible */
@@ -193,7 +200,9 @@ static int _bisect_forward_serialno(OggV
       bisect=(searched+endsearched)/2;
     }
     
-    _seek_helper(vf,bisect);
+    ret=_seek_helper(vf,bisect);
+    if(ret)return(ret);
+
     ret=_get_next_page(vf,&og,-1);
     if(ret==OV_EREAD)return(OV_EREAD);
     if(ret<0 || ogg_page_serialno(&og)!=currentno){
@@ -204,7 +213,9 @@ static int _bisect_forward_serialno(OggV
     }
   }
 
-  _seek_helper(vf,next);
+  ret=_seek_helper(vf,next);
+  if(ret)return(ret);
+
   ret=_get_next_page(vf,&og,-1);
   if(ret==OV_EREAD)return(OV_EREAD);
   
@@ -303,17 +314,23 @@ static void _prefetch_all_headers(OggVor
     if(i==0){
       /* we already grabbed the initial header earlier.  Just set the offset */
       vf->dataoffsets[i]=dataoffset;
-      _seek_helper(vf,dataoffset);
+      ret=_seek_helper(vf,dataoffset);
+      if(ret)
+	vf->dataoffsets[i]=-1;
 
     }else{
 
       /* seek to the location of the initial header */
 
-      _seek_helper(vf,vf->offsets[i]);
-      if(_fetch_headers(vf,vf->vi+i,vf->vc+i,NULL,NULL)<0){
-    	vf->dataoffsets[i]=-1;
+      ret=_seek_helper(vf,vf->offsets[i]);
+      if(ret){
+	vf->dataoffsets[i]=-1;
       }else{
-	vf->dataoffsets[i]=vf->offset;
+	if(_fetch_headers(vf,vf->vi+i,vf->vc+i,NULL,NULL)<0){
+	  vf->dataoffsets[i]=-1;
+	}else{
+	  vf->dataoffsets[i]=vf->offset;
+	}
       }
     }
 
@@ -367,21 +384,27 @@ static void _prefetch_all_headers(OggVor
        get the last page of the stream */
     {
       ogg_int64_t end=vf->offsets[i+1];
-      _seek_helper(vf,end);
-
-      while(1){
-	ret=_get_prev_page(vf,&og);
-	if(ret<0){
-	  /* this should not be possible */
-	  vorbis_info_clear(vf->vi+i);
-	  vorbis_comment_clear(vf->vc+i);
-	  break;
-	}
-	if(ogg_page_granulepos(&og)!=-1){
-	  vf->pcmlengths[i*2+1]=ogg_page_granulepos(&og)-vf->pcmlengths[i*2];
-	  break;
+      ret=_seek_helper(vf,end);
+      if(ret){
+	/* this should not be possible */
+	vorbis_info_clear(vf->vi+i);
+	vorbis_comment_clear(vf->vc+i);
+      }else{
+	
+	while(1){
+	  ret=_get_prev_page(vf,&og);
+	  if(ret<0){
+	    /* this should not be possible */
+	    vorbis_info_clear(vf->vi+i);
+	    vorbis_comment_clear(vf->vc+i);
+	    break;
+	  }
+	  if(ogg_page_granulepos(&og)!=-1){
+	    vf->pcmlengths[i*2+1]=ogg_page_granulepos(&og)-vf->pcmlengths[i*2];
+	    break;
+	  }
+	  vf->offset=ret;
 	}
-	vf->offset=ret;
       }
     }
   }
@@ -951,6 +974,7 @@ double ov_time_total(OggVorbis_File *vf,
 
 int ov_raw_seek(OggVorbis_File *vf,ogg_int64_t pos){
   ogg_stream_state work_os;
+  int ret;
 
   if(vf->ready_state<OPENED)return(OV_EINVAL);
   if(!vf->seekable)
@@ -967,7 +991,8 @@ int ov_raw_seek(OggVorbis_File *vf,ogg_i
 			    vf->current_serialno); /* must set serialno */
   vorbis_synthesis_restart(&vf->vd);
     
-  _seek_helper(vf,pos);
+  ret=_seek_helper(vf,pos);
+  if(ret)return(ret);
 
   /* we need to make sure the pcm_offset is set, but we don't want to
      advance the raw cursor past good packets just to get to the first
@@ -1098,7 +1123,7 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
   int link=-1;
   ogg_int64_t result=0;
   ogg_int64_t total=ov_pcm_total(vf,-1);
-
+  
   if(vf->ready_state<OPENED)return(OV_EINVAL);
   if(!vf->seekable)return(OV_ENOSEEK);
 
@@ -1139,8 +1164,9 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 	  bisect=begin+1;
       }
       
-      _seek_helper(vf,bisect);
-    
+      result=_seek_helper(vf,bisect);
+      if(result) goto seek_error;
+      
       while(begin<end){
 	result=_get_next_page(vf,&og,end-vf->offset);
 	if(result==OV_EREAD) goto seek_error;
@@ -1151,7 +1177,8 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 	    if(bisect==0) goto seek_error;
 	    bisect-=CHUNKSIZE;
 	    if(bisect<=begin)bisect=begin+1;
-	    _seek_helper(vf,bisect);
+	    result=_seek_helper(vf,bisect);
+	    if(result) goto seek_error;
 	  }
 	}else{
 	  ogg_int64_t granulepos=ogg_page_granulepos(&og);
@@ -1171,7 +1198,8 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 		end=result;
 		bisect-=CHUNKSIZE; /* an endless loop otherwise. */
 		if(bisect<=begin)bisect=begin+1;
-		_seek_helper(vf,bisect);
+		result=_seek_helper(vf,bisect);
+		if(result) goto seek_error;
 	      }else{
 		end=result;
 		endtime=granulepos;
@@ -1190,10 +1218,11 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
       ogg_packet op;
       
       /* seek */
-      _seek_helper(vf,best);
+      result=_seek_helper(vf,best);
       vf->pcm_offset=-1;
-      
-      if(_get_next_page(vf,&og,-1)<0)return(OV_EOF); /* shouldn't happen */
+      if(result) goto seek_error;
+      result=_get_next_page(vf,&og,-1);
+      if(result<0) goto seek_error;
       
       if(link!=vf->current_link){
 	/* Different link; dump entire decode machine */
@@ -1219,7 +1248,8 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
              get one with a granulepos or without the 'continued' flag
              set.  Then just use raw_seek for simplicity. */
 	  
-	  _seek_helper(vf,best);
+	  result=_seek_helper(vf,best);
+	  if(result<0) goto seek_error;
 	  
 	  while(1){
 	    result=_get_prev_page(vf,&og);

r13215.patch:
 vorbisfile.c |   26 +++++++++++++++++---------
 1 files changed, 17 insertions(+), 9 deletions(-)

--- NEW FILE r13215.patch ---
Index: lib/vorbisfile.c
===================================================================
--- lib/vorbisfile.c	(revision 13214)
+++ lib/vorbisfile.c	(revision 13215)
@@ -1330,8 +1330,14 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 	    if(result) goto seek_error;
 	  }
 	}else{
-	  ogg_int64_t granulepos=ogg_page_granulepos(&og);
+	  ogg_int64_t granulepos;
+
+	  if(ogg_page_serialno(&og)!=vf->serialnos[link])
+	    continue;
+
+	  granulepos=ogg_page_granulepos(&og);
 	  if(granulepos==-1)continue;
+	  
 	  if(granulepos<target){
 	    best=result;  /* raw offset of packet with granulepos */ 
 	    begin=vf->offset; /* raw offset of next page */
@@ -1378,7 +1384,7 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 	_decode_clear(vf);  
 	
 	vf->current_link=link;
-	vf->current_serialno=ogg_page_serialno(&og);
+	vf->current_serialno=vf->serialnos[link];
 	vf->ready_state=STREAMSET;
 	
       }else{
@@ -1403,8 +1409,9 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 	  while(1){
 	    result=_get_prev_page(vf,&og);
 	    if(result<0) goto seek_error;
-	    if(ogg_page_granulepos(&og)>-1 ||
-	       !ogg_page_continued(&og)){
+	    if(ogg_page_serialno(&og)==vf->current_serialno &&
+	       (ogg_page_granulepos(&og)>-1 ||
+		!ogg_page_continued(&og))){
 	      return ov_raw_seek(vf,result);
 	    }
 	    vf->offset=result;
@@ -1495,19 +1502,20 @@ int ov_pcm_seek(OggVorbis_File *vf,ogg_i
       
       /* suck in a new page */
       if(_get_next_page(vf,&og,-1)<0)break;
-      if(vf->current_serialno!=ogg_page_serialno(&og))_decode_clear(vf);
+      if(ogg_page_bos(&og))_decode_clear(vf);
       
       if(vf->ready_state<STREAMSET){
+	long serialno=ogg_page_serialno(&og);
 	int link;
 	
-	vf->current_serialno=ogg_page_serialno(&og);
 	for(link=0;link<vf->links;link++)
-	  if(vf->serialnos[link]==vf->current_serialno)break;
-	if(link==vf->links)return(OV_EBADLINK);
+	  if(vf->serialnos[link]==serialno)break;
+	if(link==vf->links) continue; 
 	vf->current_link=link;
 	
-	ogg_stream_reset_serialno(&vf->os,vf->current_serialno); 
 	vf->ready_state=STREAMSET;      
+	vf->current_serialno=ogg_page_serialno(&og);
+	ogg_stream_reset_serialno(&vf->os,serialno); 
 	ret=_make_decode_ready(vf);
 	if(ret)return ret;
 	lastblock=0;

r13217-CVE-2007-4065.patch:
 vorbisfile.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE r13217-CVE-2007-4065.patch ---
Index: lib/vorbisfile.c
===================================================================
--- lib/vorbisfile.c	(revision 13216)
+++ lib/vorbisfile.c	(revision 13217)
@@ -1356,7 +1355,7 @@ int ov_pcm_seek_page(OggVorbis_File *vf,
 		result=_seek_helper(vf,bisect);
 		if(result) goto seek_error;
 	      }else{
-		end=result;
+		end=bisect;
 		endtime=granulepos;
 		break;
 	      }


Index: libvorbis.spec
===================================================================
RCS file: /cvs/dist/rpms/libvorbis/FC-6/libvorbis.spec,v
retrieving revision 1.24
retrieving revision 1.25
diff -u -r1.24 -r1.25
--- libvorbis.spec	12 Jul 2006 06:58:43 -0000	1.24
+++ libvorbis.spec	10 Aug 2007 01:32:50 -0000	1.25
@@ -7,11 +7,30 @@
 License:	BSD
 URL:		http://www.xiph.org/
 Source:		http://www.xiph.org/ogg/vorbis/download/%{name}-%{version}.tar.gz
-Patch:		libvorbis-1.0-m4.patch
 BuildRoot:	%{_tmppath}/%{name}-%{version}-root
 Requires:	libogg >= 2:1.1
 BuildPrereq: 	libogg-devel >= 2:1.1
 
+Patch0:		libvorbis-1.0-m4.patch
+
+# It was a black day...
+Patch1: r13149.patch
+Patch2: r13151.patch
+Patch3: r13153.patch
+Patch4: r13154.patch
+Patch5: r13155.patch
+Patch6: r13160-CVE-2007-3106.patch
+Patch7: r13162.patch
+Patch8: r13167.patch
+Patch9: r13168.patch
+Patch10: r13169.patch
+Patch11: r13170.patch
+Patch12: r13172.patch
+Patch13: r13179.patch
+Patch14: r13211.patch
+Patch15: r13215.patch
+Patch16: r13217-CVE-2007-4065.patch
+
 %description
 Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free,
 general-purpose compressed audio format for audio and music at fixed
@@ -34,7 +53,27 @@
 %prep
 
 %setup -q
-%patch -p1 -b .m4-patch
+
+%patch0 -p1 -b .m4-patch
+
+%patch1 -p0 -b r13149
+%patch2 -p0 -b r13151
+%patch3 -p0 -b r13153
+%patch4 -p0 -b r13154
+%patch5 -p0 -b r13155
+%patch6 -p0 -b r13160-CVE-2007-3106
+%patch7 -p0 -b r13162
+%patch8 -p0 -b r13167
+%patch9 -p0 -b r13168
+%patch10 -p0 -b r13169
+%patch11 -p0 -b r13170
+%patch12 -p0 -b r13172
+%patch13 -p0 -b r13179
+%patch14 -p0 -b r13211
+%patch15 -p0 -b r13215
+%patch16 -p0 -b r13217-CVE-2007-4065
+
+
 perl -p -i -e "s/-O20/$RPM_OPT_FLAGS/" configure
 perl -p -i -e "s/-ffast-math//" configure
 # link to .pdf spec rather than ship redundant copy
@@ -82,6 +121,10 @@
 %postun -p /sbin/ldconfig
 
 %changelog
+* Thu Aug  9 2007 Behdad Esfahbod <besfahbo at redhat.com> - 1:1.1.2-3
+- Add 16 patches to fix various CVEs.
+- Resolves: #250600
+
 * Wed Jul 12 2006 Jesse Keating <jkeating at redhat.com> - 1:1.1.2-1.2.1
 - rebuild
 




More information about the fedora-cvs-commits mailing list