1diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c 2--- a/media/libtremor/lib/tremor_floor1.c 3+++ b/media/libtremor/lib/tremor_floor1.c 4@@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack 5 6 /* read the post list */ 7 info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */ 8 rangebits=oggpack_read(opb,4); 9 if(rangebits<0)goto err_out; 10 11 for(j=0,k=0;j<info->partitions;j++){ 12 count+=info->class_dim[info->partitionclass[j]]; 13+ if(count>VIF_POSIT)goto err_out; 14 for(;k<count;k++){ 15 int t=info->postlist[k+2]=oggpack_read(opb,rangebits); 16 if(t<0 || t>=(1<<rangebits)) 17 goto err_out; 18 } 19 } 20 info->postlist[0]=0; 21 info->postlist[1]=1<<rangebits; 22