Add bounds check to resolve buffer over-read

Fixes #1038 ofst over-reads past the end of the pSoundData buffer. Add a bounds check similar to S_CheckAmplitude() in codemp/client/snd_dma.cpp. 69800e8
JACoders · Jun 9, 2020 · 4974446 · 4974446
1 parent 5203023
commit 4974446
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/codemp/client/snd_mix.cpp b/codemp/client/snd_mix.cpp
@@ -281,6 +281,9 @@ static void S_PaintChannelFrom16( channel_t *ch, const sfx_t *sfx, int count, in
 
 	for ( int i=0 ; i<count ; i++ )
 	{
+		// have we run off the end?
+		if ((int)ofst >= sfx->iSoundLengthInSamples)
+			break;
 		iData = sfx->pSoundData[ (int)ofst ];
 
 		pSamplesDest[i].left  += (iData * iLeftVol )>>8;