Skip to content

Commit

Permalink
Fix NULL pointer dereference in S3CalculateRandomizedFields (#284)
Browse files Browse the repository at this point in the history
If the sound has been muted (!gS3_enabled) during game data loading, it
is then possible to unmute it during gameplay and request a sound effect
which doesn't have a sample loaded (most prominent for pratcam sfx).
While logic in `S3StartSound` accommodates for such a case by loading
the missing sample, it first calls `S3CalculateRandomizedFields`, which
triggers a NULL pointer dereference on platforms with memory protection.
This bug is most likely an overlook from the DOS era.

Fix this by checking for NULL pointer before use.

Signed-off-by: Artur Rojek <contact@artur-rojek.eu>
  • Loading branch information
zear committed Feb 22, 2023
1 parent 41d45f9 commit 48b70bb
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/S3/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ else()
/wd4996
)
endif()
if(DETHRACE_FIX_BUGS)
target_compile_definitions(s3 PRIVATE DETHRACE_FIX_BUGS)
endif()

if(IS_BIGENDIAN)
target_compile_definitions(s3 PRIVATE BR_ENDIAN_BIG=1)
Expand Down
7 changes: 7 additions & 0 deletions src/S3/audio.c
Original file line number Diff line number Diff line change
Expand Up @@ -962,6 +962,13 @@ void S3CalculateRandomizedFields(tS3_channel* chan, tS3_descriptor* desc) {
chan->left_volume = vol;
chan->right_volume = vol;
if (desc->type == eS3_ST_sample) {
#if defined(DETHRACE_FIX_BUGS)
/* Avoid a possible NULL pointer dereference. */
if (desc->sound_data == NULL) {
chan->rate = desc->min_pitch;
return;
}
#endif
chan->rate = S3IRandomBetweenLog(desc->min_pitch, desc->max_pitch, ((tS3_sample*)desc->sound_data)->rate);
}
}
Expand Down

0 comments on commit 48b70bb

Please sign in to comment.