[Scummvm-git-logs] scummvm master -> e4c5c52fba369eff3f04fd8e4c7c1228265bc95d

[dreammaster]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
e4c5c52fba ULTIMA: ULTIMA6: Fix out-of-bounds read in FM-Towns sound decoder


Commit: e4c5c52fba369eff3f04fd8e4c7c1228265bc95d
    https://github.com/scummvm/scummvm/commit/e4c5c52fba369eff3f04fd8e4c7c1228265bc95d
Author: PushmePullyu (127053144+PushmePullyu at users.noreply.github.com)
Date: 2023-05-22T20:32:20-07:00

Commit Message:
ULTIMA: ULTIMA6: Fix out-of-bounds read in FM-Towns sound decoder

FMtownsDecoderStream::readBuffer():
Do not treat the contents of raw_audio_buf as 16-bit values
via READ_LE_UINT16. The FM-Towns audio consists of 8-bit samples,
so no endianness handling is needed.

This fixes an out-of-bounds read when the last element of
unsigned char *raw_audio_buf is accessed as an uint16.

The bug does not result in bad audio, since the additional bits are
zeroed in FMtownsDecoderStream::convertSample().

Changed paths:
    engines/ultima/nuvie/sound/decoder/fm_towns_decoder_stream.cpp


diff --git a/engines/ultima/nuvie/sound/decoder/fm_towns_decoder_stream.cpp b/engines/ultima/nuvie/sound/decoder/fm_towns_decoder_stream.cpp
index 973090419cf..a0620aeeda9 100644
--- a/engines/ultima/nuvie/sound/decoder/fm_towns_decoder_stream.cpp
+++ b/engines/ultima/nuvie/sound/decoder/fm_towns_decoder_stream.cpp
@@ -75,7 +75,7 @@ int FMtownsDecoderStream::readBuffer(sint16 *buffer, const int numSamples) {
 	//DEBUG(0,LEVEL_INFORMATIONAL, "numSamples = %d. buf_pos = %d, buf_len = %d\n", numSamples, buf_pos, buf_len);
 
 	for (; j < numSamples && i < buf_len;) {
-		buffer[j] = convertSample(READ_LE_UINT16(&raw_audio_buf[i]));
+		buffer[j] = convertSample(static_cast<uint16>(raw_audio_buf[i]));
 		j++;
 		i++;
 	}