tree 5ab554ef40f90d0c76d1343f5b8dab68d35e010d
parent 96a9da808427ef004d1bcabc1117143038d51ec6
author Sam Lantinga <slouken@libsdl.org> 1497310755 -0700
committer Sam Lantinga <slouken@libsdl.org> 1497310755 -0700

Fixed bug 3668 - Overflow of SDL_AudioCVT.filters with some downmixes

Simon Hug

There's a chance that an audio conversion from many channels to a few can use more than 9 audio filters. SDL_AudioCVT has 10 SDL_AudioFilter pointers of which one has to be the terminating NULL pointer. The SDL code has no checks for this limit. If it overflows there can be stack or heap corruption or a call to 0xa.

Attached patch adds a function that checks for this limit and throws an error if it is reached. Also adds some documentation.

Test parameters that trigger this issue:
AUDIO_U16MSB with 224 channels at 46359 Hz
                 V
AUDIO_S16MSB with 6 channels at 27463 Hz

The fuzzer program I uploaded in bug 3667 has more of them.