Bug fix: Crash with fuzzing data

Fixes #22

Author: hajimehoshi

fuzzing_test.go

@@ -27,8 +27,9 @@ func (b *bytesReadCloser) Close() error {
 	return nil
 }
 
-func TestFuzzingIssue3(t *testing.T) {
+func TestFuzzing(t *testing.T) {
 	inputs := []string{
+		// #3
 		"\xff\xfa500000000000\xff\xff0000" +
 			"00000000000000000000" +
 			"00000000000000000000" +
@@ -75,6 +76,13 @@ func TestFuzzingIssue3(t *testing.T) {
 			"\xee\u007f\xff\xff\u007f\xff\xff\u007f\xff\xff\xfc\xee\xff\xef\xbf0\xef\xbf00" +
 			"0\xff\xee\u007f\xff\xff\u007f\xff\xff\xee\u007f\xff\xff\u007f\xff\xff\u007f\xff0\t" +
 			"\xff\xff\xee\xee",
+		// #22
+		"\xff\xfa%00000000000000000" +
+			"000000000000s0000000" +
+			"00000000000000000000" +
+			"00000000000000000000" +
+			"00000000000000000000" +
+			"00000000000000000000",
 	}
 	for _, input := range inputs {
 		b := &bytesReadCloser{bytes.NewReader([]byte(input))}

internal/frame/frame.go

@@ -623,8 +623,9 @@ func (f *Frame) subbandSynthesis(gr int, ch int, out []byte) {
 	// Setup the n_win windowing vector and the v_vec intermediate vector
 	for ss := 0; ss < 18; ss++ { // Loop through 18 samples in 32 subbands
 		copy(f.v_vec[ch][64:1024], f.v_vec[ch][0:1024-64])
+		d := f.mainData.Is[gr][ch]
 		for i := 0; i < 32; i++ { // Copy next 32 time samples to a temp vector
-			s_vec[i] = f.mainData.Is[gr][ch][i*18+ss]
+			s_vec[i] = d[i*18+ss]
 		}
 		for i := 0; i < 64; i++ { // Matrix multiply input with n_win[][] matrix
 			sum := float32(0)

internal/maindata/huffman.go

@@ -59,6 +59,10 @@ func readHuffman(m *bits.Bits, header frameheader.FrameHeader, sideInfo *sideinf
 	}
 	// Read big_values using tables according to region_x_start
 	for is_pos := 0; is_pos < sideInfo.BigValues[gr][ch]*2; is_pos++ {
+		// #22
+		if is_pos >= len(mainData.Is[gr][ch]) {
+			return fmt.Errorf("mp3: is_pos was too big: %d", is_pos)
+		}
 		table_num := 0
 		if is_pos < region_1_start {
 			table_num = sideInfo.TableSelect[gr][ch][0]