1diff --git a/media/libtremor/lib/tremor_floor1.c b/media/libtremor/lib/tremor_floor1.c
2--- a/media/libtremor/lib/tremor_floor1.c
3+++ b/media/libtremor/lib/tremor_floor1.c
4@@ -103,16 +103,17 @@ static vorbis_info_floor *floor1_unpack
5
6   /* read the post list */
7   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */
8   rangebits=oggpack_read(opb,4);
9   if(rangebits<0)goto err_out;
10
11   for(j=0,k=0;j<info->partitions;j++){
12     count+=info->class_dim[info->partitionclass[j]];
13+    if(count>VIF_POSIT)goto err_out;
14     for(;k<count;k++){
15       int t=info->postlist[k+2]=oggpack_read(opb,rangebits);
16       if(t<0 || t>=(1<<rangebits))
17 	goto err_out;
18     }
19   }
20   info->postlist[0]=0;
21   info->postlist[1]=1<<rangebits;
22