Sprinter/mame
2
0
Fork 0
mirror of https://github.com/holub/mame synced 2025-10-04 00:23:43 +03:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix invalid std::vector<> lookup in aviio.cpp

Browse Source 
This fixes a case where:
* m_soundbuf_samples == processedsamples
* processedsamples > 0
* processedsamples * stream->channels() == m_soundbuf.size()

In this scenario, the std::memmove() would do nothing (moving zero
bytes), but the operator[] on the second parameter to std::memmove()
overflows the array.  This can be benign in optimized builds (because
the third parameter to std::memmove() is 0), but on debugging builds
this can cause an assert.
This commit is contained in:
npwoods 2019-11-03 15:25:04 -05:00 committed by Vas Crabb
parent e896b3914e
commit 66f7e4fe0c
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/lib/util/aviio.cpp
View File

@ -3550,7 +3550,8 @@ avi_file::error avi_file_impl::soundbuf_flush(bool only_flush_full)
if (processedsamples > 0) if (processedsamples > 0)
{ {
/* first account for the samples we processed */ /* first account for the samples we processed */
std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample); if (m_soundbuf_samples > processedsamples)
std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample);
for (int channel = 0; channel < stream->channels(); channel++) for (int channel = 0; channel < stream->channels(); channel++)
m_soundbuf_chansamples[channel] -= processedsamples; m_soundbuf_chansamples[channel] -= processedsamples;
} }