SDL_mixer: stb_vorbis.c: Fix floor1 inverse_db_table indexing (924ff)

SDL Commits
1 
From 924ff5b63165c382a1ebb0bfec03a28f14f078ac Mon Sep 17 00:00:00 2001
From: Ozkan Sezer <[EMAIL REDACTED]>
Date: Mon, 13 Jul 2026 07:11:14 +0300
Subject: [PATCH] stb_vorbis.c: Fix floor1 inverse_db_table indexing

CVE-2019-13220 fix added y&255 mask in draw_line(). However, do_floor()
has an inline optimization equivalent to draw_line(target,lx,ly,n,ly,n2)
without the same mask.
draw_line() uses inverse_db_table[y&255], but this doesn't. If bad input
causes ly to exceed 255, this can read past the end of inverse_db_table.
c.f.: https://github.com/nothings/stb/issues/1934.
Mainstream P/R https://github.com/nothings/stb/pull/1973

(cherry picked from commit ce30df3a979eceab256671d7b7b4e11c52744b9c)
---
 src/codecs/stb_vorbis/stb_vorbis.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/codecs/stb_vorbis/stb_vorbis.h b/src/codecs/stb_vorbis/stb_vorbis.h
index e559a639..1170d941 100644
--- a/src/codecs/stb_vorbis/stb_vorbis.h
+++ b/src/codecs/stb_vorbis/stb_vorbis.h
@@ -3266,7 +3266,7 @@ static int do_floor(vorb *f, Mapping *map, int i, int n, float *target, YTYPE *f
       if (lx < n2) {
          // optimization of: draw_line(target, lx,ly, n,ly, n2);
          for (j=lx; j < n2; ++j)
-            LINE_OP(target[j], inverse_db_table[ly]);
+            LINE_OP(target[j], inverse_db_table[ly&255]);
          CHECK(f);
       }
    }