Skip to content
Snippets Groups Projects
Commit b9869856 authored by Anthony Léonard's avatar Anthony Léonard Committed by Guillaume Roguez
Browse files

coreaudio: fix buffer overflow on silence writing


The count argument passed to std::fill_n was in bytes instead of
element's count (which are of Float32 type) so zeroes were written
outside the scope of the audio buffer.

This was causing crashes not on this instruction but anywhere in the
application when a malloc call was checking for memory sanity (which
isn't done on every allocation).

Change-Id: Iec6fa9d3b00b828c6bf798c77419b8bad970d6e1
Reviewed-by: default avatarGuillaume Roguez <guillaume.roguez@savoirfairelinux.com>
parent 4c5d785a
No related branches found
No related tags found
No related merge requests found
...@@ -312,7 +312,7 @@ CoreLayer::write(AudioUnitRenderActionFlags* ioActionFlags, ...@@ -312,7 +312,7 @@ CoreLayer::write(AudioUnitRenderActionFlags* ioActionFlags,
if (toPlay.frames() == 0) { if (toPlay.frames() == 0) {
for (int i = 0; i < audioFormat_.nb_channels; ++i) for (int i = 0; i < audioFormat_.nb_channels; ++i)
std::fill_n(reinterpret_cast<Float32*>(ioData->mBuffers[i].mData), std::fill_n(reinterpret_cast<Float32*>(ioData->mBuffers[i].mData),
ioData->mBuffers[i].mDataByteSize, 0); ioData->mBuffers[i].mDataByteSize/sizeof(Float32), 0);
} else { } else {
for (int i = 0; i < audioFormat_.nb_channels; ++i) for (int i = 0; i < audioFormat_.nb_channels; ++i)
toPlay.channelToFloat(reinterpret_cast<Float32*>(ioData->mBuffers[i].mData), i); toPlay.channelToFloat(reinterpret_cast<Float32*>(ioData->mBuffers[i].mData), i);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment