fixed buffer overflow

git-svn-id: http://svn.code.sf.net/p/qmmp-dev/code/trunk/qmmp@6586 90c681e8-e032-0410-971d-27865f9a5e38

2 files changed, 16 insertions, 8 deletions

diff --git a/src/qmmp/outputwriter.cpp b/src/qmmp/outputwriter.cpp
index d5a19d561..b1cc8668c 100644
--- a/src/qmmp/outputwriter.cpp
+++ b/src/qmmp/outputwriter.cpp
@@ -53,7 +53,6 @@ OutputWriter::OutputWriter (QObject* parent) : QThread (parent)
     m_format_converter = 0;
     m_channel_converter = 0;
     m_output_buf = 0;
-    m_output_at = 0;
 }
 
 OutputWriter::~OutputWriter()
@@ -104,8 +103,8 @@ bool OutputWriter::initialize(quint32 freq, ChannelMap map)
 
     if(m_output_buf)
         delete[] m_output_buf;
-    m_output_buf = new unsigned char[QMMP_BLOCK_FRAMES * m_channels * m_output->sampleSize() * 4];
-    m_output_at = 0;
+    m_output_size = QMMP_BLOCK_FRAMES * m_channels * 4;
+    m_output_buf = new unsigned char[m_output_size * m_output->sampleSize()];
 
     m_bytesPerMillisecond = m_frequency * m_channels * AudioParameters::sampleSize(m_format) / 1000;
     m_recycler.configure(m_in_params.sampleRate(), m_in_params.channels()); //calculate output buffer size
@@ -274,6 +273,7 @@ void OutputWriter::run()
     Buffer *b = 0;
     quint64 l;
     qint64 m = 0;
+    size_t output_at = 0;
 
     dispatch(Qmmp::Playing);
 
@@ -334,10 +334,18 @@ void OutputWriter::run()
             l = 0;
             m = 0;
 
+            //increase buffer size if needed
+            if(b->samples > m_output_size)
+            {
+                delete [] m_output_buf;
+                m_output_size = b->samples;
+                m_output_buf = new unsigned char[m_output_size * sampleSize()];
+            }
+
             m_format_converter->fromFloat(b->data, m_output_buf, b->samples);
-            m_output_at = b->samples * m_output->sampleSize();
+            output_at = b->samples * m_output->sampleSize();
 
-            while (l < m_output_at && !m_pause && !m_prev_pause)
+            while (l < output_at && !m_pause && !m_prev_pause)
             {
                 mutex()->lock();
                 if(m_skip)
@@ -348,7 +356,7 @@ void OutputWriter::run()
                     break;
                 }
                 mutex()->unlock();
-                m = m_output->writeAudio(m_output_buf + l, m_output_at - l);
+                m = m_output->writeAudio(m_output_buf + l, output_at - l);
                 if(m >= 0)
                 {
                     m_totalWritten += m;
diff --git a/src/qmmp/outputwriter_p.h b/src/qmmp/outputwriter_p.h
index 3aceb4d20..f2c8ad523 100644
--- a/src/qmmp/outputwriter_p.h
+++ b/src/qmmp/outputwriter_p.h
@@ -1,5 +1,5 @@
 /***************************************************************************
- *   Copyright (C) 2012-2015 by Ilya Kotov                                 *
+ *   Copyright (C) 2012-2016 by Ilya Kotov                                 *
  *   forkotov02@hotmail.ru                                                 *
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
@@ -141,7 +141,7 @@ private:
     AudioConverter *m_format_converter;
     ChannelConverter *m_channel_converter;
     unsigned char *m_output_buf;
-    size_t m_output_at;
+    size_t m_output_size; //samples
 };
 
 #endif // OUTPUTWRITER_P_H