Skip to content

Commit

Permalink
Fix crash in hlsSystem::ComputePlayInfo(), DescentDevelopers#141
Browse files Browse the repository at this point in the history
sound_seg was -1, which crashes in BOA_INDEX(sound_seg) on 64bit
platforms (by pure luck it doesn't seem to crash on 32bit platforms)

It makes sense to catch this problem much earlier in Play3dSound(),
to avoid executing all the superfluous
  • Loading branch information
DanielGibson committed Apr 23, 2024
1 parent 86a6c13 commit 41c4578
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions sndlib/hlsoundlib.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -922,6 +922,16 @@ bool hlsSystem::ComputePlayInfo(int sound_obj_index, vector *virtual_pos, vector
sound_seg = m_sound_objects[sound_obj_index].m_link_info.pos_info.segnum;
}

// sound_seg == -1 causes crashes when BOA_INDEX() calls TERRAIN_REGION()
// with that value (though by pure luck on 32bit platforms the overflow
// and truncation will likely use an address that doesn't crash,
// but is still invalid). At least one case that could cause this was fixed,
// if there are others, the ASSERT should tell us about it
// (and if assertions are disabled, return false to handle this gracefully)
ASSERT(sound_seg != -1);
if (sound_seg == -1)
return false;

sound_seg = BOA_INDEX(sound_seg);
ear_seg = BOA_INDEX(Viewer_object->roomnum);
if (!BOA_IsSoundAudible(sound_seg, ear_seg))
Expand Down Expand Up @@ -1079,6 +1089,11 @@ int hlsSystem::Play3dSound(int sound_index, pos_state *cur_pos, object *cur_obj,
return -1;
if (sound_index >= MAX_SOUNDS || Sounds[sound_index].used == 0)
return -1;
// if the position doesn't belong to any valid room or cell,
// all this would fail anyway (in Emulate3dSound() -> ComputePlayInfo()),
// so might as well give up now
if (cur_pos->roomnum == -1)
return -1;
// initialize sound.
Sound_system.CheckAndForceSoundDataAlloc(sound_index);
int sample_offset = offset * 22050.0f;
Expand Down

0 comments on commit 41c4578

Please sign in to comment.