ext/speex/gstspeexdec.c: Fix bounds checking of mode in Speex header, which may produce negative numbers in speex < 1...

Original commit message from CVS:
* ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
Fix bounds checking of mode in Speex header, which may
produce negative numbers in speex < 1.1.12

2 files changed, 7 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 1feb9402..b418e46d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2008-04-11  Jan Schmidt  <Jan.Schmidt@sun.com>
+
+	* ext/speex/gstspeexdec.c: (speex_dec_chain_parse_header):
+	Fix bounds checking of mode in Speex header, which may
+	produce negative numbers in speex < 1.1.12
+
 2008-04-09  Tim-Philipp Müller  <tim at centricular dot net>
 
 	* gst/goom/Makefile.am:
diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c
index fbd71258..48d16052 100644
--- a/ext/speex/gstspeexdec.c
+++ b/ext/speex/gstspeexdec.c
@@ -507,7 +507,7 @@ speex_dec_chain_parse_header (GstSpeexDec * dec, GstBuffer * buf)
   if (!dec->header)
     goto no_header;
 
-  if (dec->header->mode >= SPEEX_NB_MODES)
+  if (dec->header->mode >= SPEEX_NB_MODES || dec->header->mode < 0)
     goto mode_too_old;
 
   dec->mode = (SpeexMode *) speex_mode_list[dec->header->mode];