[Scummvm-git-logs] scummvm master -> a54bee9430f35efd50ea1dc0fb553f830b7277b6

[sluicebox]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
a54bee9430 SCI: Fix corruption when "prefer_digitalsfx" is false


Commit: a54bee9430f35efd50ea1dc0fb553f830b7277b6
    https://github.com/scummvm/scummvm/commit/a54bee9430f35efd50ea1dc0fb553f830b7277b6
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2021-06-14T16:58:40-05:00

Commit Message:
SCI: Fix corruption when "prefer_digitalsfx" is false

Fixes an out of bounds write that occurs when the config setting
"prefer_digitalsfx" is false and a game plays a sound resource
that contains a digital channel, such as SQ1.

The MIDI branch of SciMusic:soundInitSnd() wasn't skipping the
digital channel, which has the number 0xFE, and so it used that
to index the 16 element channel array.

This problem didn't become apparent until recently when
"prefer_digitalsfx" was fixed to apply to these sounds:
648d669c2dd3ddeaeb3d2ab4d3480ae08be85dd4

Changed paths:
    engines/sci/sound/music.cpp


diff --git a/engines/sci/sound/music.cpp b/engines/sci/sound/music.cpp
index d0188b8b20..2c469f7a3e 100644
--- a/engines/sci/sound/music.cpp
+++ b/engines/sci/sound/music.cpp
@@ -454,8 +454,14 @@ void SciMusic::soundInitSnd(MusicEntry *pSnd) {
 			for (int i = 0; i < 16; ++i)
 				pSnd->_usedChannels[i] = 0xFF;
 			for (int i = 0; i < track->channelCount; ++i) {
+				// skip digital channel
+				if (i == track->digitalChannelNr) {
+					continue;
+				}
+
 				SoundResource::Channel &chan = track->channels[i];
 
+				assert(chan.number < ARRAYSIZE(pSnd->_chan));
 				pSnd->_usedChannels[i] = chan.number;
 				pSnd->_chan[chan.number]._dontRemap = (chan.flags & 2);
 				pSnd->_chan[chan.number]._prio = chan.prio;