[OMPT-svn-commit] SF.net SVN: modplug:[1997] trunk/OpenMPT/soundlib

[<man...@us...>]

Revision: 1997
          http://sourceforge.net/p/modplug/code/1997
Author:   manxorist
Date:     2013-04-28 19:40:37 +0000 (Sun, 28 Apr 2013)
Log Message:
-----------
[Fix] Fix buffer overflow in X86_InterleaveFrontRear which had probably been there forever (fixes crashes in quad channel mode).

Modified Paths:
--------------
    trunk/OpenMPT/soundlib/Fastmix.cpp
    trunk/OpenMPT/soundlib/Sndmix.cpp

Modified: trunk/OpenMPT/soundlib/Fastmix.cpp
===================================================================
--- trunk/OpenMPT/soundlib/Fastmix.cpp	2013-04-28 16:56:58 UTC (rev 1996)
+++ trunk/OpenMPT/soundlib/Fastmix.cpp	2013-04-28 19:40:37 UTC (rev 1997)
@@ -2163,16 +2163,17 @@
 #endif
 
 
-void X86_InterleaveFrontRear(int *pFrontBuf, int *pRearBuf, DWORD nSamples)
-//-------------------------------------------------------------------------
+void X86_InterleaveFrontRear(int *pFrontBuf, int *pRearBuf, DWORD nFrames)
+//------------------------------------------------------------------------
 {
+#ifdef ENABLE_X86
 	_asm {
-	mov ecx, nSamples	// ecx = samplecount
+	mov ecx, nFrames	// ecx = framecount
 	mov esi, pFrontBuf	// esi = front buffer
 	mov edi, pRearBuf	// edi = rear buffer
-	lea esi, [esi+ecx*4]	// esi = &front[N]
-	lea edi, [edi+ecx*4]	// edi = &rear[N]
-	lea ebx, [esi+ecx*4]	// ebx = &front[N*2]
+	lea esi, [esi+ecx*8]	// esi = &front[N*2]
+	lea edi, [edi+ecx*8]	// edi = &rear[N*2]
+	lea ebx, [esi+ecx*8]	// ebx = &front[N*4]
 	push ebp
 interleaveloop:
 	mov eax, dword ptr [esi-8]
@@ -2190,6 +2191,16 @@
 	jnz interleaveloop
 	pop ebp
 	}
+#else
+	// copy backwards as we are writing back into FrontBuf
+	for(int i=nFrames-1; i>=0; i--)
+	{
+		pFrontBuf[i*4+3] = pRearBuf[i*2+1];
+		pFrontBuf[i*4+2] = pRearBuf[i*2+0];
+		pFrontBuf[i*4+1] = pFrontBuf[i*2+1];
+		pFrontBuf[i*4+0] = pFrontBuf[i*2+0];
+	}
+#endif
 }
 
 

Modified: trunk/OpenMPT/soundlib/Sndmix.cpp
===================================================================
--- trunk/OpenMPT/soundlib/Sndmix.cpp	2013-04-28 16:56:58 UTC (rev 1996)
+++ trunk/OpenMPT/soundlib/Sndmix.cpp	2013-04-28 19:40:37 UTC (rev 1997)
@@ -43,7 +43,7 @@
 #ifdef ENABLE_X86
 extern VOID X86_Dither(int *pBuffer, UINT nSamples, UINT nBits);
 #endif
-extern VOID X86_InterleaveFrontRear(int *pFrontBuf, int *pRearBuf, DWORD nSamples);
+extern VOID X86_InterleaveFrontRear(int *pFrontBuf, int *pRearBuf, DWORD nFrames);
 extern VOID X86_StereoFill(int *pBuffer, UINT nSamples, LPLONG lpROfs, LPLONG lpLOfs);
 extern VOID X86_MonoFromStereo(int *pMixBuf, UINT nSamples);
 
@@ -265,7 +265,7 @@
 #endif // NO_REVERB
 
 		// Resetting sound buffer
-		X86_StereoFill(MixSoundBuffer, lSampleCount, &gnDryROfsVol, &gnDryLOfsVol);
+		X86_StereoFill(MixSoundBuffer, lCount, &gnDryROfsVol, &gnDryLOfsVol);
 		
 		ASSERT(lCount<=MIXBUFFERSIZE);		// ensure MIXBUFFERSIZE really is our max buffer size
 		if (m_MixerSettings.gnChannels >= 2)
@@ -337,7 +337,7 @@
 		// Multichannel
 		if (m_MixerSettings.gnChannels > 2)
 		{
-			X86_InterleaveFrontRear(MixSoundBuffer, MixRearBuffer, lSampleCount);
+			X86_InterleaveFrontRear(MixSoundBuffer, MixRearBuffer, lCount);
 			lTotalSampleCount *= 2;
 		}
 

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.