mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 17:55:23 +02:00
Henrik Rydgård
4239c29928
raw_bytes_per_frame (the 'fmt ' chunk's blockAlign field) is unvalidated file data, and was used unchecked in three places: - Divided into the 'data' chunk size to compute numFrames - a value of 0 divides by zero (crash). - malloc()'d for raw_data was never null-checked before ReadData() wrote into it. - Passed directly as the read length to the audio decoder on every frame, regardless of how much data is actually left in raw_data at the current offset - a bogus blockAlign larger than the real 'data' chunk size reads past the (padded) allocation into the decoder. Clamp it to what's actually available. IsSimpleWAV() only checked raw_bytes_per_frame's upper bound, not that it exactly matched one of the two cases Sample::Load() actually handles (16-bit or 8-bit raw PCM) - a value in between passed the check but matched neither of Load()'s conversion branches, leaving its output buffer uninitialized and played back as heap garbage. Reachable via a WAV/AT3 file parsed by BackgroundAudio.cpp - either the menu background music preview (any EBOOT.PBP's SND0.AT3 track, just from browsing the game list) or a user-configurable achievement sound file.