Skip to content

Commit 3b862ef

Browse files
KonstantyKonstanty
committed
Merge branch 'modplug_fuzz'
After a long series of fuzz sessions by Lionel Debroux, a large number of OOB reads and some OOB writes have been identified and fixed in libmodplug. In addition there were also some divide by zero problems.
2 parents 2c32855 + c615692 commit 3b862ef

20 files changed

+364
-257
lines changed

‎src/fastmix.cpp‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ CzCUBICSPLINE sspline;
146146
fir interpolation doc,
147147
(derived from "an engineer's guide to fir digital filters", n.j. loy)
148148
149-
calculate coefficients for ideal lowpass filter (with cutoff = fc in
149+
calculate coefficients for ideal lowpass filter (with cutoff = fc in
150150
0..1 (mapped to 0..nyquist))
151151
c[-N..N] = (i==0) ? fc : sin(fc*pi*i)/(pi*i)
152152
@@ -189,56 +189,56 @@ CzCUBICSPLINE sspline;
189189
#define M_zBESSELEPS 1e-21
190190

191191
class CzWINDOWEDFIR
192-
{
192+
{
193193
public:
194194
CzWINDOWEDFIR( );
195195
~CzWINDOWEDFIR( );
196-
float coef( int _PCnr, float _POfs, float _PCut, int _PWidth, int _PType )
196+
float coef( int _PCnr, float _POfs, float _PCut, int _PWidth, int _PType )
197197
//OLD args to coef: float _PPos, float _PFc, int _PLen )
198-
{
198+
{
199199
double _LWidthM1 = _PWidth-1;
200200
double _LWidthM1Half = 0.5*_LWidthM1;
201201
double _LPosU = ((double)_PCnr - _POfs);
202202
double _LPos = _LPosU-_LWidthM1Half;
203203
double _LPIdl = 2.0*M_zPI/_LWidthM1;
204204
double _LWc,_LSi;
205-
if( fabs(_LPos)<M_zEPS ) {
205+
if( fabs(_LPos)<M_zEPS ) {
206206
_LWc = 1.0;
207207
_LSi = _PCut;
208-
} else {
208+
} else {
209209
switch( _PType )
210-
{
210+
{
211211
case WFIR_HANN:
212212
_LWc = 0.50 - 0.50 * cos(_LPIdl*_LPosU);
213213
break;
214214
case WFIR_HAMMING:
215215
_LWc = 0.54 - 0.46 * cos(_LPIdl*_LPosU);
216216
break;
217217
case WFIR_BLACKMANEXACT:
218-
_LWc = 0.42 - 0.50 * cos(_LPIdl*_LPosU) +
218+
_LWc = 0.42 - 0.50 * cos(_LPIdl*_LPosU) +
219219
0.08 * cos(2.0*_LPIdl*_LPosU);
220220
break;
221221
case WFIR_BLACKMAN3T61:
222-
_LWc = 0.44959 - 0.49364 * cos(_LPIdl*_LPosU) +
222+
_LWc = 0.44959 - 0.49364 * cos(_LPIdl*_LPosU) +
223223
0.05677 * cos(2.0*_LPIdl*_LPosU);
224224
break;
225225
case WFIR_BLACKMAN3T67:
226-
_LWc = 0.42323 - 0.49755 * cos(_LPIdl*_LPosU) +
226+
_LWc = 0.42323 - 0.49755 * cos(_LPIdl*_LPosU) +
227227
0.07922 * cos(2.0*_LPIdl*_LPosU);
228228
break;
229229
case WFIR_BLACKMAN4T92:
230-
_LWc = 0.35875 - 0.48829 * cos(_LPIdl*_LPosU) +
231-
0.14128 * cos(2.0*_LPIdl*_LPosU) -
230+
_LWc = 0.35875 - 0.48829 * cos(_LPIdl*_LPosU) +
231+
0.14128 * cos(2.0*_LPIdl*_LPosU) -
232232
0.01168 * cos(3.0*_LPIdl*_LPosU);
233233
break;
234234
case WFIR_BLACKMAN4T74:
235-
_LWc = 0.40217 - 0.49703 * cos(_LPIdl*_LPosU) +
236-
0.09392 * cos(2.0*_LPIdl*_LPosU) -
235+
_LWc = 0.40217 - 0.49703 * cos(_LPIdl*_LPosU) +
236+
0.09392 * cos(2.0*_LPIdl*_LPosU) -
237237
0.00183 * cos(3.0*_LPIdl*_LPosU);
238238
break;
239239
case WFIR_KAISER4T:
240-
_LWc = 0.40243 - 0.49804 * cos(_LPIdl*_LPosU) +
241-
0.09831 * cos(2.0*_LPIdl*_LPosU) -
240+
_LWc = 0.40243 - 0.49804 * cos(_LPIdl*_LPosU) +
241+
0.09831 * cos(2.0*_LPIdl*_LPosU) -
242242
0.00122 * cos(3.0*_LPIdl*_LPosU);
243243
break;
244244
default:
@@ -256,14 +256,14 @@ class CzWINDOWEDFIR
256256
signed short CzWINDOWEDFIR::lut[WFIR_LUTLEN*WFIR_WIDTH];
257257

258258
CzWINDOWEDFIR::CzWINDOWEDFIR()
259-
{
259+
{
260260
int _LPcl;
261261
float _LPcllen = (float)(1L<<WFIR_FRACBITS); // number of precalculated lines for 0..1 (-1..0)
262262
float _LNorm = 1.0f / (float)(2.0f * _LPcllen);
263263
float _LCut = WFIR_CUTOFF;
264264
float _LScale = (float)WFIR_QUANTSCALE;
265265
for( _LPcl=0;_LPcl<WFIR_LUTLEN;_LPcl++ )
266-
{
266+
{
267267
float _LGain,_LCoefs[WFIR_WIDTH];
268268
float _LOfs = ((float)_LPcl-_LPcllen)*_LNorm;
269269
int _LCc,_LIdx = _LPcl<<WFIR_LOG2WIDTH;
@@ -348,7 +348,7 @@ CzWINDOWEDFIR sfir;
348348
CzCUBICSPLINE::lut[poslo+1]*(int)p[poshi ] + \
349349
CzCUBICSPLINE::lut[poslo+3]*(int)p[poshi+2] + \
350350
CzCUBICSPLINE::lut[poslo+2]*(int)p[poshi+1]) >> SPLINE_8SHIFT;
351-
351+
352352
#define SNDMIX_GETMONOVOL16SPLINE \
353353
int poshi = nPos >> 16; \
354354
int poslo = (nPos >> SPLINE_FRACSHIFT) & SPLINE_FRACMASK; \
@@ -1275,39 +1275,39 @@ const LPMIXINTERFACE gpMixFunctionTable[2*2*16] =
12751275
{
12761276
// No SRC
12771277
Mono8BitMix, Mono16BitMix, Stereo8BitMix, Stereo16BitMix,
1278-
Mono8BitRampMix, Mono16BitRampMix, Stereo8BitRampMix,
1278+
Mono8BitRampMix, Mono16BitRampMix, Stereo8BitRampMix,
12791279
Stereo16BitRampMix,
12801280
// No SRC, Filter
1281-
FilterMono8BitMix, FilterMono16BitMix, FilterStereo8BitMix,
1282-
FilterStereo16BitMix, FilterMono8BitRampMix, FilterMono16BitRampMix,
1281+
FilterMono8BitMix, FilterMono16BitMix, FilterStereo8BitMix,
1282+
FilterStereo16BitMix, FilterMono8BitRampMix, FilterMono16BitRampMix,
12831283
FilterStereo8BitRampMix, FilterStereo16BitRampMix,
12841284
// Linear SRC
12851285
Mono8BitLinearMix, Mono16BitLinearMix, Stereo8BitLinearMix,
12861286
Stereo16BitLinearMix, Mono8BitLinearRampMix, Mono16BitLinearRampMix,
12871287
Stereo8BitLinearRampMix,Stereo16BitLinearRampMix,
12881288
// Linear SRC, Filter
1289-
FilterMono8BitLinearMix, FilterMono16BitLinearMix,
1289+
FilterMono8BitLinearMix, FilterMono16BitLinearMix,
12901290
FilterStereo8BitLinearMix, FilterStereo16BitLinearMix,
12911291
FilterMono8BitLinearRampMix, FilterMono16BitLinearRampMix,
12921292
FilterStereo8BitLinearRampMix, FilterStereo16BitLinearRampMix,
12931293

12941294
// FirFilter SRC
1295-
Mono8BitSplineMix, Mono16BitSplineMix, Stereo8BitSplineMix,
1295+
Mono8BitSplineMix, Mono16BitSplineMix, Stereo8BitSplineMix,
12961296
Stereo16BitSplineMix, Mono8BitSplineRampMix, Mono16BitSplineRampMix,
12971297
Stereo8BitSplineRampMix,Stereo16BitSplineRampMix,
12981298
// Spline SRC, Filter
1299-
FilterMono8BitSplineMix, FilterMono16BitSplineMix,
1299+
FilterMono8BitSplineMix, FilterMono16BitSplineMix,
13001300
FilterStereo8BitSplineMix, FilterStereo16BitSplineMix,
13011301
FilterMono8BitSplineRampMix, FilterMono16BitSplineRampMix,
13021302
FilterStereo8BitSplineRampMix, FilterStereo16BitSplineRampMix,
13031303

13041304
// FirFilter SRC
13051305
Mono8BitFirFilterMix, Mono16BitFirFilterMix, Stereo8BitFirFilterMix,
1306-
Stereo16BitFirFilterMix, Mono8BitFirFilterRampMix,
1307-
Mono16BitFirFilterRampMix, Stereo8BitFirFilterRampMix,
1306+
Stereo16BitFirFilterMix, Mono8BitFirFilterRampMix,
1307+
Mono16BitFirFilterRampMix, Stereo8BitFirFilterRampMix,
13081308
Stereo16BitFirFilterRampMix,
13091309
// FirFilter SRC, Filter
1310-
FilterMono8BitFirFilterMix, FilterMono16BitFirFilterMix,
1310+
FilterMono8BitFirFilterMix, FilterMono16BitFirFilterMix,
13111311
FilterStereo8BitFirFilterMix, FilterStereo16BitFirFilterMix,
13121312
FilterMono8BitFirFilterRampMix, FilterMono16BitFirFilterRampMix,
13131313
FilterStereo8BitFirFilterRampMix, FilterStereo16BitFirFilterRampMix
@@ -1320,39 +1320,39 @@ const LPMIXINTERFACE gpFastMixFunctionTable[2*2*16] =
13201320
FastMono8BitRampMix, FastMono16BitRampMix, Stereo8BitRampMix,
13211321
Stereo16BitRampMix,
13221322
// No SRC, Filter
1323-
FilterMono8BitMix, FilterMono16BitMix, FilterStereo8BitMix,
1323+
FilterMono8BitMix, FilterMono16BitMix, FilterStereo8BitMix,
13241324
FilterStereo16BitMix, FilterMono8BitRampMix, FilterMono16BitRampMix,
13251325
FilterStereo8BitRampMix, FilterStereo16BitRampMix,
13261326
// Linear SRC
13271327
FastMono8BitLinearMix, FastMono16BitLinearMix, Stereo8BitLinearMix,
1328-
Stereo16BitLinearMix, FastMono8BitLinearRampMix,
1329-
FastMono16BitLinearRampMix, Stereo8BitLinearRampMix,
1328+
Stereo16BitLinearMix, FastMono8BitLinearRampMix,
1329+
FastMono16BitLinearRampMix, Stereo8BitLinearRampMix,
13301330
Stereo16BitLinearRampMix,
13311331
// Linear SRC, Filter
1332-
FilterMono8BitLinearMix, FilterMono16BitLinearMix,
1332+
FilterMono8BitLinearMix, FilterMono16BitLinearMix,
13331333
FilterStereo8BitLinearMix, FilterStereo16BitLinearMix,
1334-
FilterMono8BitLinearRampMix, FilterMono16BitLinearRampMix,
1334+
FilterMono8BitLinearRampMix, FilterMono16BitLinearRampMix,
13351335
FilterStereo8BitLinearRampMix, FilterStereo16BitLinearRampMix,
13361336

13371337
// Spline SRC
1338-
Mono8BitSplineMix, Mono16BitSplineMix, Stereo8BitSplineMix,
1338+
Mono8BitSplineMix, Mono16BitSplineMix, Stereo8BitSplineMix,
13391339
Stereo16BitSplineMix, Mono8BitSplineRampMix, Mono16BitSplineRampMix,
13401340
Stereo8BitSplineRampMix, Stereo16BitSplineRampMix,
13411341
// Spline SRC, Filter
1342-
FilterMono8BitSplineMix, FilterMono16BitSplineMix,
1342+
FilterMono8BitSplineMix, FilterMono16BitSplineMix,
13431343
FilterStereo8BitSplineMix, FilterStereo16BitSplineMix,
1344-
FilterMono8BitSplineRampMix, FilterMono16BitSplineRampMix,
1344+
FilterMono8BitSplineRampMix, FilterMono16BitSplineRampMix,
13451345
FilterStereo8BitSplineRampMix, FilterStereo16BitSplineRampMix,
13461346

13471347
// FirFilter SRC
13481348
Mono8BitFirFilterMix, Mono16BitFirFilterMix, Stereo8BitFirFilterMix,
1349-
Stereo16BitFirFilterMix, Mono8BitFirFilterRampMix,
1350-
Mono16BitFirFilterRampMix, Stereo8BitFirFilterRampMix,
1349+
Stereo16BitFirFilterMix, Mono8BitFirFilterRampMix,
1350+
Mono16BitFirFilterRampMix, Stereo8BitFirFilterRampMix,
13511351
Stereo16BitFirFilterRampMix,
13521352
// FirFilter SRC, Filter
1353-
FilterMono8BitFirFilterMix, FilterMono16BitFirFilterMix,
1353+
FilterMono8BitFirFilterMix, FilterMono16BitFirFilterMix,
13541354
FilterStereo8BitFirFilterMix, FilterStereo16BitFirFilterMix,
1355-
FilterMono8BitFirFilterRampMix, FilterMono16BitFirFilterRampMix,
1355+
FilterMono8BitFirFilterRampMix, FilterMono16BitFirFilterRampMix,
13561356
FilterStereo8BitFirFilterRampMix, FilterStereo16BitFirFilterRampMix,
13571357
};
13581358

@@ -1375,7 +1375,7 @@ static LONG MPPFASTCALL GetSampleCount(MODCHANNEL *pChn, LONG nSamples)
13751375
LONG nDelta = ((nLoopStart - pChn->nPos) << 16) - (pChn->nPosLo & 0xffff);
13761376
pChn->nPos = nLoopStart | (nDelta>>16);
13771377
pChn->nPosLo = nDelta & 0xffff;
1378-
if (((LONG)pChn->nPos < nLoopStart) ||
1378+
if (((LONG)pChn->nPos < nLoopStart) ||
13791379
(pChn->nPos >= (nLoopStart+pChn->nLength)/2))
13801380
{
13811381
pChn->nPos = nLoopStart; pChn->nPosLo = 0;
@@ -1391,7 +1391,7 @@ static LONG MPPFASTCALL GetSampleCount(MODCHANNEL *pChn, LONG nSamples)
13911391
}
13921392
} else
13931393
{
1394-
// We probably didn't hit the loop end yet
1394+
// We probably didn't hit the loop end yet
13951395
// (first loop), so we do nothing
13961396
if ((LONG)pChn->nPos < 0) pChn->nPos = 0;
13971397
}
@@ -1414,8 +1414,8 @@ static LONG MPPFASTCALL GetSampleCount(MODCHANNEL *pChn, LONG nSamples)
14141414
LONG nDeltaLo = 0x10000 - (pChn->nPosLo & 0xffff);
14151415
pChn->nPos = pChn->nLength - nDeltaHi - (nDeltaLo>>16);
14161416
pChn->nPosLo = nDeltaLo & 0xffff;
1417-
if ((pChn->nPos <= pChn->nLoopStart) ||
1418-
(pChn->nPos >= pChn->nLength))
1417+
if ((pChn->nPos <= pChn->nLoopStart) ||
1418+
(pChn->nPos >= pChn->nLength))
14191419
pChn->nPos = pChn->nLength-1;
14201420
} else
14211421
{
@@ -1426,7 +1426,7 @@ static LONG MPPFASTCALL GetSampleCount(MODCHANNEL *pChn, LONG nSamples)
14261426
}
14271427
// Restart at loop start
14281428
pChn->nPos += nLoopStart - pChn->nLength;
1429-
if ((LONG)pChn->nPos < nLoopStart)
1429+
if ((LONG)pChn->nPos < nLoopStart)
14301430
pChn->nPos = pChn->nLoopStart;
14311431
}
14321432
}
@@ -1503,7 +1503,7 @@ UINT CSoundFile::CreateStereoMix(int count)
15031503
if (!(pChannel->dwFlags & CHN_NOIDO))
15041504
{
15051505
// use hq-fir mixer?
1506-
if( (gdwSoundSetup & (SNDMIX_HQRESAMPLER|SNDMIX_ULTRAHQSRCMODE)) ==
1506+
if( (gdwSoundSetup & (SNDMIX_HQRESAMPLER|SNDMIX_ULTRAHQSRCMODE)) ==
15071507
(SNDMIX_HQRESAMPLER|SNDMIX_ULTRAHQSRCMODE) )
15081508
nFlags += MIXNDX_FIRSRC;
15091509
else if( (gdwSoundSetup & (SNDMIX_HQRESAMPLER)) == SNDMIX_HQRESAMPLER )
@@ -1873,7 +1873,7 @@ DWORD MPPASMCALL X86_Convert32To24(LPVOID lp16, int *pBuffer, DWORD lSampleCount
18731873
int vumin = *lpMin, vumax = *lpMax;
18741874
int n,p ;
18751875
unsigned char* buf = (unsigned char*)lp16 ;
1876-
1876+
18771877
for ( i=0; i<lSampleCount; i++)
18781878
{
18791879
n = pBuffer[i];
@@ -1971,7 +1971,7 @@ DWORD MPPASMCALL X86_Convert32To32(LPVOID lp16, int *pBuffer, DWORD lSampleCount
19711971
UINT i ;
19721972
int vumin = *lpMin, vumax = *lpMax;
19731973
int32_t *p = (int32_t *)lp16;
1974-
1974+
19751975
for ( i=0; i<lSampleCount; i++)
19761976
{
19771977
int n = pBuffer[i];
@@ -2358,7 +2358,7 @@ void CSoundFile::ProcessAGC(int count)
23582358
static DWORD gAGCRecoverCount = 0;
23592359
UINT agc = X86_AGC(MixSoundBuffer, count, gnAGC);
23602360
// Some kind custom law, so that the AGC stays quite stable, but slowly
2361-
// goes back up if the sound level stays below a level inversely
2361+
// goes back up if the sound level stays below a level inversely
23622362
// proportional to the AGC level. (J'me comprends)
23632363
if ((agc >= gnAGC) && (gnAGC < AGC_UNITY) && (gnVUMeter < (0xFF - (gnAGC >> (AGC_PRECISION-7))) ))
23642364
{

‎src/load_669.cpp‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -155,9 +155,9 @@ BOOL CSoundFile::Read669(const BYTE *lpStream, DWORD dwMemLength)
155155
case 0x03: command = CMD_MODCMDEX; param |= 0x50; break;
156156
case 0x04: command = CMD_VIBRATO; param |= 0x40; break;
157157
case 0x05: if (param) command = CMD_SPEED; else command = 0; param += 2; break;
158-
case 0x06: if (param == 0) { command = CMD_PANNINGSLIDE; param = 0xFE; } else
159-
if (param == 1) { command = CMD_PANNINGSLIDE; param = 0xEF; } else
160-
command = 0;
158+
case 0x06: if (param == 0) { command = CMD_PANNINGSLIDE; param = 0xFE; }
159+
else if (param == 1) { command = CMD_PANNINGSLIDE; param = 0xEF; }
160+
else command = 0;
161161
break;
162162
default: command = 0;
163163
}
@@ -191,5 +191,3 @@ BOOL CSoundFile::Read669(const BYTE *lpStream, DWORD dwMemLength)
191191
}
192192
return TRUE;
193193
}
194-
195-

0 commit comments

Comments
 (0)