From f0ef8f3cc2a4be273acd7f9934cc625f99d143ef Mon Sep 17 00:00:00 2001
From: Chris Purnell <46072656+chrispurnell@users.noreply.github.com>
Date: Fri, 16 Jun 2023 19:15:43 +0100
Subject: [PATCH] Fix some out of bound array access. (#862)

---
 src/Cafe/OS/libs/snd_core/ax_internal.h | 18 +-----------------
 src/Cafe/OS/libs/snd_user/snd_user.cpp  |  4 ++--
 2 files changed, 3 insertions(+), 19 deletions(-)

diff --git a/src/Cafe/OS/libs/snd_core/ax_internal.h b/src/Cafe/OS/libs/snd_core/ax_internal.h
index 215b9ca7..c2880343 100644
--- a/src/Cafe/OS/libs/snd_core/ax_internal.h
+++ b/src/Cafe/OS/libs/snd_core/ax_internal.h
@@ -150,23 +150,7 @@ namespace snd_core
 			/* +0x1E4 */ uint16 a1;
 			/* +0x1E6 */ uint16 a2;
 		}biquad;
-		uint16 reserved1E8[1];
-		uint16 reserved1EA;
-		uint16 reserved1EC;
-		uint16 reserved1EE;
-		uint32 reserved1F0[4];
-		uint16 reserved200;
-		uint16 reserved202;
-		uint16 reserved204;
-		uint16 reserved206;
-		uint16 reserved208;
-		uint16 reserved20A;
-		uint16 reserved20C;
-		uint16 reserved20E;
-		uint16 reserved210;
-		uint16 reserved212;
-		uint16 reserved214;
-		uint16 reserved216;
+		uint16 reserved1E8[0x18];
 		uint16 reserved218[0x20]; // not related to device mix?
 		uint16 reserved258[0x10]; // not related to device mix?
 		// rmt src related
diff --git a/src/Cafe/OS/libs/snd_user/snd_user.cpp b/src/Cafe/OS/libs/snd_user/snd_user.cpp
index b413f576..4b884f68 100644
--- a/src/Cafe/OS/libs/snd_user/snd_user.cpp
+++ b/src/Cafe/OS/libs/snd_user/snd_user.cpp
@@ -247,7 +247,7 @@ namespace snd
 			channel->drc_control[index].fader = 0;
 			channel->drc_control[index].lfe = -960;
 
-			for (size_t i = 0; i < AX_MAX_NUM_BUS; ++i)
+			for (size_t i = 0; i < AX_AUX_BUS_COUNT; ++i)
 			{
 				channel->drc_control[index].aux[i] = -960;
 			}
@@ -272,7 +272,7 @@ namespace snd
 			channel->rmt_control[index].fader = 0;
 			channel->rmt_control[index].lfe = -960;
 
-			for (size_t i = 0; i < AX_MAX_NUM_BUS; ++i)
+			for (size_t i = 0; i < AX_AUX_BUS_COUNT; ++i)
 			{
 				channel->rmt_control[index].aux[i] = -960;
 			}