From e781f6b4a22f10df68701551be3aff01e1974d26 Mon Sep 17 00:00:00 2001 From: SarahW Date: Wed, 9 Jun 2021 20:04:17 +0100 Subject: [PATCH] midi_alsa: Increase maximum sysex message to 65536 bytes, and cap regular messages at 3 bytes. Fixes out-of-bounds corruption and crashes. --- src/midi_alsa.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/midi_alsa.c b/src/midi_alsa.c index f513c23..5b8a2cc 100644 --- a/src/midi_alsa.c +++ b/src/midi_alsa.c @@ -124,7 +124,7 @@ static int midi_pos, midi_len; static uint8_t midi_command[4]; static int midi_lengths[8] = {3, 3, 3, 3, 2, 2, 3, 1}; static int midi_insysex; -static uint8_t midi_sysex_data[1024+2]; +static uint8_t midi_sysex_data[65536]; void midi_write(uint8_t val) { @@ -143,7 +143,7 @@ void midi_write(uint8_t val) { midi_sysex_data[midi_pos++] = val; - if (val == 0xf7 || midi_pos >= 1024+2) + if (val == 0xf7 || midi_pos >= 65536) { /* pclog("MIDI send sysex %i: ", midi_pos); for (int i = 0; i < midi_pos; i++) @@ -157,15 +157,18 @@ void midi_write(uint8_t val) } if (midi_len) - { - midi_command[midi_pos] = val; - - midi_pos++; - - if (midi_pos == midi_len) + { + if (midi_pos < 3) { -// pclog("MIDI send %i: %02x %02x %02x %02x\n", midi_len, midi_command[0], midi_command[1], midi_command[2], midi_command[3]); - snd_rawmidi_write(midiout, midi_command, midi_len); + midi_command[midi_pos] = val; + + midi_pos++; + + if (midi_pos == midi_len) + { +// pclog("MIDI send %i: %02x %02x %02x %02x\n", midi_len, midi_command[0], midi_command[1], midi_command[2], midi_command[3]); + snd_rawmidi_write(midiout, midi_command, midi_len); + } } } }