1 files changed, 14 insertions, 1 deletions
diff --git a/apps/codecs/libtremor/sharedbook.c b/apps/codecs/libtremor/sharedbook.c
index 9519976c95..884920ecda 100644
--- a/apps/codecs/libtremor/sharedbook.c
+++ b/apps/codecs/libtremor/sharedbook.c
@@ -122,7 +122,20 @@ static ogg_uint32_t *_make_words(long *l,long n,long sparsecount){
     }else
       if(sparsecount==0)count++;
   }
-    
+
+  /* sanity check the huffman tree; an underpopulated tree must be
+     rejected. The only exception is the one-node pseudo-nil tree,
+     which appears to be underpopulated because the tree doesn't
+     really exist; there's only one possible 'codeword' or zero bits,
+     but the above tree-gen code doesn't mark that. */
+  if(sparsecount != 1){
+    for(i=1;i<33;i++)
+      if(marker[i] & (0xffffffffUL>>(32-i))){
+       _ogg_free(r);
+       return(NULL);
+      }
+  }
+
   /* bitreverse the words because our bitwise packer/unpacker is LSb
      endian */
   for(i=0,count=0;i<n;i++){