#4 SoundTouch crashes in overlap() if offset is negative

[Jamie Bullock]

In TDStretch.cpp:665 seekBestOverlapPosition() returns offset as an int

This is subsequently cast to a uint in the following call on line 671:

overlap(outputBuffer.ptrEnd((uint)overlapLength), inputBuffer.ptrBegin(), (uint)offset);

Since it is possible for offset to be negative, the value passed to overlap() can be UINT_MAX causing a crash due to reading out of bounds memory in the input vector for one of the overlap() functions

[oparviai]

Hello, thanks for the bug report! This issue is fixed in the SVN development repository rev236, please see here:

https://sourceforge.net/p/soundtouch/code/236/tree/

[Jamie Bullock]

Thanks! I just checkout the latest svn and I confirm that this issue is now fixed for me.