Retro/pcem
Watch
1
0
Fork
You've already forked pcem
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

midi_alsa: Increase maximum sysex message to 65536 bytes, and cap regular

Browse source 
messages at 3 bytes. Fixes out-of-bounds corruption and crashes.
This commit is contained in:
SarahW 2021-06-09 20:04:17 +01:00
commit e781f6b4a2
1 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/midi_alsa.c
View file

@ -124,7 +124,7 @@ static int midi_pos, midi_len;
static uint8_t midi_command[4];
static int midi_lengths[8] = {3, 3, 3, 3, 2, 2, 3, 1};
static int midi_insysex;
static uint8_t midi_sysex_data[1024+2];
static uint8_t midi_sysex_data[65536];
void midi_write(uint8_t val)
{
@ -143,7 +143,7 @@ void midi_write(uint8_t val)
{
midi_sysex_data[midi_pos++] = val;
if (val == 0xf7 || midi_pos >= 1024+2)
if (val == 0xf7 || midi_pos >= 65536)
{
/* pclog("MIDI send sysex %i: ", midi_pos);
for (int i = 0; i < midi_pos; i++)
@ -157,15 +157,18 @@ void midi_write(uint8_t val)
}
if (midi_len)
{
midi_command[midi_pos] = val;
midi_pos++;
if (midi_pos == midi_len)
{
if (midi_pos < 3)
{
// pclog("MIDI send %i: %02x %02x %02x %02x\n", midi_len, midi_command[0], midi_command[1], midi_command[2], midi_command[3]);
snd_rawmidi_write(midiout, midi_command, midi_len);
midi_command[midi_pos] = val;
midi_pos++;
if (midi_pos == midi_len)
{
// pclog("MIDI send %i: %02x %02x %02x %02x\n", midi_len, midi_command[0], midi_command[1], midi_command[2], midi_command[3]);
snd_rawmidi_write(midiout, midi_command, midi_len);
}
}
}
}