PaulStoffregen / Audio

Teensy Audio Library
http://www.pjrc.com/teensy/td_libs_Audio.html
1.07k stars 398 forks source link

Fixing buffer overflow bug in AudioSynthToneSweep. #462

Open sah opened 1 year ago

sah commented 1 year ago

AudioSynthToneSweep had a buffer overflow caused by incorrect handling of the bp pointer when filling the remainder of the buffer with 0s. It only overflowed by one entry, but this was sometimes causing a crash when ending a tone sweep. Here's how it worked:

bp = block->data;
...
for(i = 0;i < AUDIO_BLOCK_SAMPLES;i++) {
    // let's say it's the last time through this loop, so i == AUDIO_BLOCK_SAMPLES - 1
    *bp++ = ...;  // this line increments bp after writing to *bp.
    ...
    if (...) {
        // now, this if block executes
        break;
    }
}
// because of the break statement, i is still AUDIO_BLOCK_SAMPLES - 1 here
while(i < AUDIO_BLOCK_SAMPLES) {
    // uh oh, bp has already been incremented past the end of the buffer
    *bp++ = 0;
    i++;
}