From ff516b6202887561e7b5ce13cab589f69e62d6e0 Mon Sep 17 00:00:00 2001 From: itsmattkc Date: Sun, 23 Feb 2020 22:20:01 +1100 Subject: [PATCH] audiorenderworker: added assert for problematic audio behavior that could corrupt the heap --- app/render/backend/audiorenderworker.cpp | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/app/render/backend/audiorenderworker.cpp b/app/render/backend/audiorenderworker.cpp index 2a0dcd0db..f6c45c15c 100644 --- a/app/render/backend/audiorenderworker.cpp +++ b/app/render/backend/audiorenderworker.cpp @@ -47,11 +47,9 @@ NodeValueTable AudioRenderWorker::RenderBlock(const TrackOutput *track, const Ti TimeRange range_for_block(qMax(b->in(), range.in()), qMin(b->out(), range.out())); + // Destination buffer NodeValueTable table = ProcessNode(NodeDependency(b, range_for_block)); - QByteArray samples_from_this_block = table.Take(NodeParam::kSamples).toByteArray(); - int destination_offset = audio_params_.time_to_bytes(range_for_block.in() - range.in()); - int maximum_copy_size = audio_params_.time_to_bytes(range_for_block.length()); if (!samples_from_this_block.isEmpty()) { // Stretch samples here @@ -80,11 +78,23 @@ NodeValueTable AudioRenderWorker::RenderBlock(const TrackOutput *track, const Ti AudioManager::ReverseBuffer(samples_from_this_block.data(), samples_from_this_block.size(), audio_params_.samples_to_bytes(1)); } - int actual_copy_size = qMin(maximum_copy_size, samples_from_this_block.size()); + int destination_offset = audio_params_.time_to_bytes(range_for_block.in() - range.in()); + int actual_copy_size = qMin(audio_params_.time_to_bytes(range_for_block.length()), samples_from_this_block.size()); - memcpy(block_range_buffer.data()+destination_offset, - samples_from_this_block.data(), - actual_copy_size); + if (destination_offset < 0 + || destination_offset + actual_copy_size < 0 + || destination_offset >= block_range_buffer.size() + || destination_offset + actual_copy_size >= block_range_buffer.size()) { + qCritical() << "Tried to copy audio beyond the size of the destination buffer"; + qCritical() << " Destination size:" << block_range_buffer.size(); + qCritical() << " Destination offset:" << destination_offset; + qCritical() << " Copy size:" << actual_copy_size; + abort(); + } else { + memcpy(block_range_buffer.data()+destination_offset, + samples_from_this_block.data(), + actual_copy_size); + } } NodeValueTable::Merge({merged_table, table});