Fix crash when playing SFX with invalid audio indices#5043
Open
HeresHavi wants to merge 1 commit into
Open
Conversation
playSFX and playSFX3D accepted sound numbers outside the available list. A sufficiently large negative number caused the client to read invalid memory and crash.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Added sound index and archive metadata checks before accessing the fixed-size SFX table.
Invalid
playSFXandplaySFX3Dcalls now returnfalseinstead of reading unrelated memory or crashing the client.Motivation
The SFX reader accessed
bankHeader.sounds[audioIndex]before checking whether the index was valid. A far-out negative index could point outside the table and cause an access violation while reading the sound metadata.For example, a resource might choose an SFX index from a configuration file or generated list. If that value becomes negative or exceeds the number of sounds in the bank, playing it could crash the player's client.
The reader now also checks the archive sound count and offsets before calculating the sound length. This prevents invalid archive metadata from producing another out-of-bounds read or unsigned length error.
Crash Stack
Test plan
Runtime
playSFX("genrl", 0, -10000000, false)caused an access violation inCAudioContainerSA::GetRawAudioData.playSFXreturnedfalsefor indices-1and-10000000, and the client stayed open.playSFX3Dreturnedfalsefor index-10000000.playSFXandplaySFX3Dplayback still returned sound elements.Builds and Tests
Debug | Win32: Full build passed, 304 client tests passed.Release | Win32: Full build passed, 304 client tests passed.clang-format.Checklist