[Bug 12349] DSOUND_MixInBuffer Assertion `dsb->buf_mixpos + len <= dsb-> tmp_buffer_len' failed
wine-bugs at winehq.org
wine-bugs at winehq.org
Fri Apr 4 05:43:48 CDT 2008
http://bugs.winehq.org/show_bug.cgi?id=12349
--- Comment #2 from Jörg Höhle <hoehle at users.sourceforge.net> 2008-04-04 05:43:48 ---
Fix heap off by one error as "for (i = 0; i < len; i+=2)" loops once
with len=1 even though it must not.
This is exactly what happened in this trace (with 16 bits per sample):
trace:dsound:DSOUND_MixerVol (0x1359528,2048)
trace:dsound:DSOUND_MixerVol (0x1359528,2050)
Program ran was fine as long as len was a multiple of 4, not just 2.
This patch code is put under the same copyright as wine as of version
0.9.58, c.f. src/git/wine/{LICENSE,COPYING.LIB}
2008-04-03 Jörg Höhle <hoehle at users.sourceforge.net>
* dlls/dsound/mixer.c:
dound: fix heap off by one overflow in DSOUND_MixerVol.
--- dlls/dsound/mixer.c.orig 2008-01-17 10:14:34.000000000 +0100
+++ dlls/dsound/mixer.c 2008-04-03 22:26:33.000000000 +0200
@@ -444,7 +444,7 @@
case 8:
/* 8-bit WAV is unsigned, but we need to operate */
/* on signed data for this to work properly */
- for (i = 0; i < len; i+=2) {
+ for (i = 1; i < len; i+=2) {
*(bpc++) = (((*(mem++) - 128) * vLeft) >> 16) + 128;
*(bpc++) = (((*(mem++) - 128) * vRight) >> 16) + 128;
}
@@ -453,7 +453,7 @@
break;
case 16:
/* 16-bit WAV is signed -- much better */
- for (i = 0; i < len; i += 4) {
+ for (i = 3; i < len; i += 4) {
*(bps++) = (*(mems++) * vLeft) >> 16;
*(bps++) = (*(mems++) * vRight) >> 16;
}
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
More information about the wine-bugs
mailing list