Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stb_vorbis: Unchecked return value from stb_vorbis_get_frame_float #1528

Open
weirddan455 opened this issue Oct 14, 2023 · 1 comment
Open

Comments

@weirddan455
Copy link

Hello, I am a developer of Dosbox Staging. As part of our CI, we have Coverity static analyzer which detected the following issue:

dosbox-staging/dosbox-staging#2996

https://user-images.githubusercontent.com/1557255/274740089-0bc591db-a476-4b6b-8a0e-d49ea08d30ac.png

Every other time stb_vorbis_get_frame_float is called, the return value is checked.

We've done some modification of the source but the function it is alerting on is unchanged:

stb/stb_vorbis.c

Lines 4919 to 4934 in beebb24

int stb_vorbis_seek(stb_vorbis *f, unsigned int sample_number)
{
if (!stb_vorbis_seek_frame(f, sample_number))
return 0;
if (sample_number != f->current_loc) {
int n;
uint32 frame_start = f->current_loc;
stb_vorbis_get_frame_float(f, &n, NULL);
assert(sample_number > frame_start);
assert(f->channel_buffer_start + (int) (sample_number-frame_start) <= f->channel_buffer_end);
f->channel_buffer_start += (sample_number - frame_start);
}
return 1;
}

I just wanted to raise this issue here in case this is a bug. Does the return value need to be checked here? It appears to be length of some sort but I was having a bit of hard time following the logic as I'm not very familiar with this code.

Thanks!

@nothings
Copy link
Owner

I would guess it's not a bug; since it's part of the seeking logic, it's intentionally consuming a frame and expecting particular behavior based on knowledge of the internals. (I didn't actually write the seeking logic though.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants