View | Details | Raw Unified | Return to bug 19681
Collapse All | Expand All

(-)a/nomad.c (-2 / +5 lines)
Lines 154-165 static int xing_parse(struct nomad *nomad) Link Here
154
		bitlen -= 32;
154
		bitlen -= 32;
155
	}
155
	}
156
	if (nomad->xing.flags & XING_TOC) {
156
	if (nomad->xing.flags & XING_TOC) {
157
		int i;
157
		int i, prev = -1;
158
158
159
		if (bitlen < 800)
159
		if (bitlen < 800)
160
			return -1;
160
			return -1;
161
		for (i = 0; i < 100; i++)
161
		for (i = 0; i < 100; i++) {
162
			nomad->xing.toc[i] = mad_bit_read(&ptr, 8);
162
			nomad->xing.toc[i] = mad_bit_read(&ptr, 8);
163
                        if (nomad->xing.toc[i] < prev || (i == 0 && !nomad->xing.toc[i])) return -1;
164
                        prev = nomad->xing.toc[i];
165
                }
163
		bitlen -= 800;
166
		bitlen -= 800;
164
	}
167
	}
165
	if (nomad->xing.flags & XING_SCALE) {
168
	if (nomad->xing.flags & XING_SCALE) {

Return to bug 19681