From 0f184a0f283aff747685868c4c1aaa567f706002 Mon Sep 17 00:00:00 2001 From: Christoph Oelckers Date: Sat, 2 Mar 2019 21:09:45 +0100 Subject: [PATCH] - reject all DMX sounds shorter than or equal 8 bytes. 8 bytes is the minimum header size for DMX, so for one byte of sample data it has to be 9 bytes. This was causing access to invalid memory when trying to read the header of something too short. For other file formats this is of no concern because none has a header this short. --- src/s_sound.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/s_sound.cpp b/src/s_sound.cpp index abc11b255..b6aefd868 100644 --- a/src/s_sound.cpp +++ b/src/s_sound.cpp @@ -1490,7 +1490,7 @@ sfxinfo_t *S_LoadSound(sfxinfo_t *sfx, FSoundLoadBuffer *pBuffer) DPrintf(DMSG_NOTIFY, "Loading sound \"%s\" (%td)\n", sfx->name.GetChars(), sfx - &S_sfx[0]); int size = Wads.LumpLength(sfx->lumpnum); - if (size > 0) + if (size > 8) { auto wlump = Wads.OpenLumpReader(sfx->lumpnum); auto sfxdata = wlump.Read(size); @@ -1556,7 +1556,7 @@ static void S_LoadSound3D(sfxinfo_t *sfx, FSoundLoadBuffer *pBuffer) else { int size = Wads.LumpLength(sfx->lumpnum); - if (size <= 0) return; + if (size <= 8) return; auto wlump = Wads.OpenLumpReader(sfx->lumpnum); auto sfxdata = wlump.Read(size);