SDL_mixer: stb_vorbis.c: Fix floor1 inverse_db_table indexing (8f6fb)

SDL Commits
1 
From 8f6fb41a866e3951c989ab1d4063a8a73b2abd35 Mon Sep 17 00:00:00 2001
From: Ozkan Sezer <[EMAIL REDACTED]>
Date: Mon, 13 Jul 2026 07:11:10 +0300
Subject: [PATCH] stb_vorbis.c: Fix floor1 inverse_db_table indexing

CVE-2019-13220 fix added y&255 mask in draw_line(). However, do_floor()
has an inline optimization equivalent to draw_line(target,lx,ly,n,ly,n2)
without the same mask.
draw_line() uses inverse_db_table[y&255], but this doesn't. If bad input
causes ly to exceed 255, this can read past the end of inverse_db_table.
c.f.: https://github.com/nothings/stb/issues/1934.
Mainstream P/R https://github.com/nothings/stb/pull/1973

(cherry picked from commit 01a5783db755bef52351d90ab7e046f66efc10e6)
---
 src/stb_vorbis/stb_vorbis.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/stb_vorbis/stb_vorbis.h b/src/stb_vorbis/stb_vorbis.h
index 3ab0e7ed..97e37ce2 100644
--- a/src/stb_vorbis/stb_vorbis.h
+++ b/src/stb_vorbis/stb_vorbis.h
@@ -3257,7 +3257,7 @@ static int do_floor(vorb *f, Mapping *map, int i, int n, float *target, YTYPE *f
       if (lx < n2) {
          // optimization of: draw_line(target, lx,ly, n,ly, n2);
          for (j=lx; j < n2; ++j)
-            LINE_OP(target[j], inverse_db_table[ly]);
+            LINE_OP(target[j], inverse_db_table[ly&255]);
          CHECK(f);
       }
    }