Fix write_audio_16bit write_audio_24bit write_audio_32bit and write_a…

…udio_float function heap buffer overflow (#204) * Fix write_audio_16bit write_audio_24bit write_audio_32bit and write_audio_float function heap buffer overflow Signed-off-by: Hao.Ding <dinghao@uniontech.com> * Fix write_audio_16bit write_audio_24bit write_audio_32bit and write_audio_float function heap buffer overflow Fix write_audio_16bit write_audio_24bit write_audio_32bit and write_audio_float function heap buffer overflow Signed-off-by: Hao Ding <dinghao@uniontech.com> --------- Signed-off-by: Hao.Ding <dinghao@uniontech.com> Signed-off-by: Hao Ding <dinghao@uniontech.com> Co-authored-by: DingHao <dinghao@uniontech.com>
knik0 · Apr 16, 2024 · abf9b32 · abf9b32
1 parent 18ee294
commit abf9b32
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/frontend/audio.c b/frontend/audio.c
@@ -323,7 +323,7 @@ static size_t write_audio_16bit(audio_file *aufile, void *sample_buffer,
 
     if (aufile->channels == 6 && aufile->channelMask)
     {
-        for (i = 0; i < samples; i += aufile->channels)
+        for (i = 0; i+6 <= samples; i += aufile->channels)
         {
             short r1, r2, r3, r4, r5, r6;
             r1 = sample_buffer16[i];
@@ -366,7 +366,7 @@ static size_t write_audio_24bit(audio_file *aufile, void *sample_buffer,
 
     if (aufile->channels == 6 && aufile->channelMask)
     {
-        for (i = 0; i < samples; i += aufile->channels)
+        for (i = 0; i+6 <= samples; i += aufile->channels)
         {
             long r1, r2, r3, r4, r5, r6;
             r1 = sample_buffer24[i];
@@ -410,7 +410,7 @@ static size_t write_audio_32bit(audio_file *aufile, void *sample_buffer,
 
     if (aufile->channels == 6 && aufile->channelMask)
     {
-        for (i = 0; i < samples; i += aufile->channels)
+        for (i = 0; i+6 <= samples; i += aufile->channels)
         {
             long r1, r2, r3, r4, r5, r6;
             r1 = sample_buffer32[i];
@@ -455,7 +455,7 @@ static size_t write_audio_float(audio_file *aufile, void *sample_buffer,
 
     if (aufile->channels == 6 && aufile->channelMask)
     {
-        for (i = 0; i < samples; i += aufile->channels)
+        for (i = 0; i+6 <= samples; i += aufile->channels)
         {
             float r1, r2, r3, r4, r5, r6;
             r1 = sample_buffer_f[i];