#6 load_dsm.cpp

[Andrei]

qmetro-code-115\src\alarm\libmodplug\load_dsm.cpp line 112

for (UINT iOrd=0; iOrd<MAX_ORDERS; iOrd++)
{
Order[iOrd] = (BYTE)((iOrd < psong->numord) ? psong->orders[iOrd] : 0xFF);
}

Buffer is accessed out of bounds: psong.orders

BYTE orders[128];

define MAX_ORDERS 256

[Andrei]

Sorry for style.
line 112: "Order[iOrd] = (BYTE)((iOrd < psong->numord) ? psong->orders[iOrd] : 0xFF);"