Commit Graph

8 Commits

Author SHA1 Message Date
Sam Lantinga
553b328664 Fixed bug 3668 - Overflow of SDL_AudioCVT.filters with some downmixes
Simon Hug

There's a chance that an audio conversion from many channels to a few can use more than 9 audio filters. SDL_AudioCVT has 10 SDL_AudioFilter pointers of which one has to be the terminating NULL pointer. The SDL code has no checks for this limit. If it overflows there can be stack or heap corruption or a call to 0xa.

Attached patch adds a function that checks for this limit and throws an error if it is reached. Also adds some documentation.

Test parameters that trigger this issue:
AUDIO_U16MSB with 224 channels at 46359 Hz
                 V
AUDIO_S16MSB with 6 channels at 27463 Hz

The fuzzer program I uploaded in bug 3667 has more of them.
2017-06-12 16:39:15 -07:00
Ryan C. Gordon
1066bcc83a audio: clarified what SDL_AudioSpec::samples is, removed note about power of 2.
These don't have to be power-of-2 sizes anymore because of SDL_AudioStream,
and the new resampler, but also, many platforms don't give you power-of-2 DMA
buffer in the first place!
2017-02-27 10:11:40 -05:00
Ryan C. Gordon
073ff7dea3 Added a note about aligning SDL_AudioCVT data. 2017-01-24 00:55:41 -05:00
Sam Lantinga
45b774e3f7 Updated copyright for 2017 2017-01-01 18:33:28 -08:00
Sam Lantinga
3615633571 Renaming of guard header names to quiet -Wreserved-id-macro
Patch contributed by Sylvain
2016-11-20 21:34:54 -08:00
Ryan C. Gordon
7315390171 audio: Implemented buffer queueing for capture devices (SDL_DequeueAudio()). 2016-08-06 02:47:27 -04:00
Sam Lantinga
42065e785d Updated copyright to 2016 2016-01-02 10:10:34 -08:00
Philipp Wiesemann
0e45984fa0 Fixed crash if initialization of EGL failed but was tried again later.
The internal function SDL_EGL_LoadLibrary() did not delete and remove a mostly
uninitialized data structure if loading the library first failed. A later try to
use EGL then skipped initialization and assumed it was previously successful
because the data structure now already existed. This led to at least one crash
in the internal function SDL_EGL_ChooseConfig() because a NULL pointer was
dereferenced to make a call to eglBindAPI().
2015-06-21 17:33:46 +02:00