From 8e20832c383c8ac73baead189f5397aa9d95b68c Mon Sep 17 00:00:00 2001
From: Monty <xiphmont@xiph.org>
Date: Thu, 25 Jun 2009 03:53:49 +0000
Subject: [PATCH] Second half of fix to Mozilla BZ # 5000254: sanity check the
 floor 1 post list to reject files with repeated values that would result in
 floor line segments with zero length.

svn path=/trunk/vorbis/; revision=16182
---
 lib/floor1.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/floor1.c b/lib/floor1.c
index 7052304..6d47459 100644
--- a/lib/floor1.c
+++ b/lib/floor1.c
@@ -120,6 +120,9 @@ static void floor1_pack (vorbis_info_floor *i,oggpack_buffer *opb){
   }
 }
 
+static int icomp(const void *a,const void *b){
+  return(**(int **)a-**(int **)b);
+}
 
 static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){
   codec_setup_info     *ci=vi->codec_setup;
@@ -164,6 +167,17 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){
   info->postlist[0]=0;
   info->postlist[1]=1<<rangebits;
 
+  /* don't allow repeated values in post list as they'd result in
+     zero-length segments */
+  {
+    int *sortpointer[VIF_POSIT+2];
+    for(j=0;j<count+2;j++)sortpointer[j]=info->postlist+j;
+    qsort(sortpointer,count+2,sizeof(*sortpointer),icomp);
+
+    for(j=1;j<count+2;j++)
+      if(*sortpointer[j-1]==*sortpointer[j])goto err_out;
+  }
+
   return(info);
 
  err_out:
@@ -171,10 +185,6 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){
   return(NULL);
 }
 
-static int icomp(const void *a,const void *b){
-  return(**(int **)a-**(int **)b);
-}
-
 static vorbis_look_floor *floor1_look(vorbis_dsp_state *vd,
                                       vorbis_info_floor *in){
 
-- 
2.7.4