summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
author npwoods <npwoods@mess.org>2019-11-03 15:25:04 -0500
committer Vas Crabb <cuavas@users.noreply.github.com>2019-11-04 13:32:22 +1100
commit66f7e4fe0cadc630e1d4d2304713afe0d2066cc6 (patch)
treeba8ad5f56c54dcce1a87c320aabf190e02a8a063
parente896b3914ecb262b5ec143b3918404d9866fa555 (diff)
Fix invalid std::vector<> lookup in aviio.cpp
This fixes a case where: * m_soundbuf_samples == processedsamples * processedsamples > 0 * processedsamples * stream->channels() == m_soundbuf.size() In this scenario, the std::memmove() would do nothing (moving zero bytes), but the operator[] on the second parameter to std::memmove() overflows the array. This can be benign in optimized builds (because the third parameter to std::memmove() is 0), but on debugging builds this can cause an assert.
-rw-r--r--src/lib/util/aviio.cpp3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/util/aviio.cpp b/src/lib/util/aviio.cpp
index 771befa9ef5..c66f706b6e2 100644
--- a/src/lib/util/aviio.cpp
+++ b/src/lib/util/aviio.cpp
@@ -3550,7 +3550,8 @@ avi_file::error avi_file_impl::soundbuf_flush(bool only_flush_full)
if (processedsamples > 0)
{
/* first account for the samples we processed */
- std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample);
+ if (m_soundbuf_samples > processedsamples)
+ std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample);
for (int channel = 0; channel < stream->channels(); channel++)
m_soundbuf_chansamples[channel] -= processedsamples;
}