Browse Source

AU Client: Avoid potential out-of-bounds write when clearing buffers

Fixes an issue introduced in 72fa2d98e1
where zeromem might write past the end of the channel buffer.
v6.1.6
reuk 3 years ago
parent
commit
288765b3c8
No known key found for this signature in database GPG Key ID: 9ADCD339CFC98A11
3 changed files with 14 additions and 12 deletions
  1. +2
    -2
      modules/juce_audio_plugin_client/AU/juce_AU_Wrapper.mm
  2. +1
    -1
      modules/juce_audio_plugin_client/AU/juce_AUv3_Wrapper.mm
  3. +11
    -9
      modules/juce_audio_processors/format_types/juce_AU_Shared.h

+ 2
- 2
modules/juce_audio_plugin_client/AU/juce_AU_Wrapper.mm View File

@@ -1346,10 +1346,10 @@ public:
if (pulledSucceeded[busIdx])
audioBuffer.set (busIdx, GetInput ((UInt32) busIdx)->GetBufferList(), mapper.get (true, busIdx));
else
audioBuffer.clearInputBus (busIdx);
audioBuffer.clearInputBus (busIdx, (int) nFrames);
}
audioBuffer.clearUnusedChannels();
audioBuffer.clearUnusedChannels ((int) nFrames);
}
// swap midi buffers


+ 1
- 1
modules/juce_audio_plugin_client/AU/juce_AUv3_Wrapper.mm View File

@@ -1617,7 +1617,7 @@ private:
for (int busIdx = 0; busIdx < numProcessorBusesIn; ++busIdx)
audioBuffer.set (busIdx, *inBusBuffers[busIdx]->get(), mapper.get (true, busIdx));
audioBuffer.clearUnusedChannels();
audioBuffer.clearUnusedChannels ((int) frameCount);
}
// process audio


+ 11
- 9
modules/juce_audio_processors/format_types/juce_AU_Shared.h View File

@@ -215,28 +215,30 @@ struct AudioUnitHelpers
}
}
void clearInputBus (int index)
void clearInputBus (int index, int bufferLength)
{
if (isPositiveAndBelow (index, inputBusOffsets.size() - 1))
clearChannels (inputBusOffsets[(size_t) index], inputBusOffsets[(size_t) (index + 1)]);
clearChannels ({ inputBusOffsets[(size_t) index], inputBusOffsets[(size_t) (index + 1)] }, bufferLength);
}
void clearUnusedChannels()
void clearUnusedChannels (int bufferLength)
{
jassert (! inputBusOffsets .empty());
jassert (! outputBusOffsets.empty());
clearChannels (inputBusOffsets.back(), outputBusOffsets.back());
clearChannels ({ inputBusOffsets.back(), outputBusOffsets.back() }, bufferLength);
}
private:
void clearChannels (int begin, int end)
void clearChannels (Range<int> range, int bufferLength)
{
if (begin <= end && end <= (int) channels.size())
jassert (bufferLength <= scratch.getNumSamples());
if (range.getEnd() <= (int) channels.size())
{
std::for_each (channels.begin() + begin,
channels.begin() + end,
[this] (float* ptr) { zeromem (ptr, sizeof (float) * (size_t) scratch.getNumSamples()); });
std::for_each (channels.begin() + range.getStart(),
channels.begin() + range.getEnd(),
[bufferLength] (float* ptr) { zeromem (ptr, sizeof (float) * (size_t) bufferLength); });
}
}


Loading…
Cancel
Save