From 91f48444523c2225d2c4a84670c43020786506ea Mon Sep 17 00:00:00 2001 From: f4exb Date: Sat, 22 Apr 2023 12:33:37 +0200 Subject: [PATCH] Rx channel demods: prevent possible reading past audio buffer end. For #1661 --- plugins/channelrx/demodam/amdemodsink.cpp | 10 +++++++--- plugins/channelrx/demodbfm/bfmdemodsink.cpp | 10 +++++++--- plugins/channelrx/demoddab/dabdemodsink.cpp | 10 +++++++--- plugins/channelrx/demoddsd/dsddemodsink.cpp | 1 - plugins/channelrx/demoddsd/dsddemodsink.h | 1 - plugins/channelrx/demodfreedv/freedvdemodsink.cpp | 10 +++++++--- plugins/channelrx/demodils/ilsdemodsink.cpp | 10 +++++++--- plugins/channelrx/demodm17/m17demodprocessor.cpp | 10 +++++++--- plugins/channelrx/demodm17/m17demodsink.cpp | 1 - plugins/channelrx/demodm17/m17demodsink.h | 1 - plugins/channelrx/demodnfm/nfmdemodsink.cpp | 12 ++++++++---- plugins/channelrx/demodssb/ssbdemodsink.cpp | 10 +++++++--- plugins/channelrx/demodvor/vordemodsink.cpp | 10 +++++++--- plugins/channelrx/demodwfm/wfmdemodsink.cpp | 10 +++++++--- plugins/channelrx/udpsink/udpsinksink.cpp | 10 +++++++--- 15 files changed, 78 insertions(+), 38 deletions(-) diff --git a/plugins/channelrx/demodam/amdemodsink.cpp b/plugins/channelrx/demodam/amdemodsink.cpp index 4e3cdea830..a792553456 100644 --- a/plugins/channelrx/demodam/amdemodsink.cpp +++ b/plugins/channelrx/demodam/amdemodsink.cpp @@ -203,11 +203,15 @@ void AMDemodSink::processOneSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("AMDemodSink::processOneSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) + if (res != m_audioBuffer.size()) { - qDebug("AMDemodSink::processOneSample: %u/%u audio samples written", res, m_audioBufferFill); + qDebug("AMDemodSink::processOneSample: %u/%lu audio samples written", res, m_audioBuffer.size()); m_audioFifo.clear(); } diff --git a/plugins/channelrx/demodbfm/bfmdemodsink.cpp b/plugins/channelrx/demodbfm/bfmdemodsink.cpp index e22acd0e21..d8d1e653c0 100644 --- a/plugins/channelrx/demodbfm/bfmdemodsink.cpp +++ b/plugins/channelrx/demodbfm/bfmdemodsink.cpp @@ -225,10 +225,14 @@ void BFMDemodSink::feed(const SampleVector::const_iterator& begin, const SampleV if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("BFMDemodSink::processOneSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if(res != m_audioBufferFill) { - qDebug("BFMDemodSink::feed: %u/%u audio samples written", res, m_audioBufferFill); + if(res != m_audioBuffer.size()) { + qDebug("BFMDemodSink::feed: %u/%lu audio samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/demoddab/dabdemodsink.cpp b/plugins/channelrx/demoddab/dabdemodsink.cpp index f73e4a59a6..94549444c1 100644 --- a/plugins/channelrx/demoddab/dabdemodsink.cpp +++ b/plugins/channelrx/demoddab/dabdemodsink.cpp @@ -446,11 +446,15 @@ void DABDemodSink::processOneAudioSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("DABDemodSink::processOneAudioSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) + if (res != m_audioBuffer.size()) { - qDebug("DABDemodSink::audio: %u/%u audio samples written", res, m_audioBufferFill); + qDebug("DABDemodSink::processOneAudioSample: %u/%lu audio samples written", res, m_audioBuffer.size()); m_audioFifo.clear(); } diff --git a/plugins/channelrx/demoddsd/dsddemodsink.cpp b/plugins/channelrx/demoddsd/dsddemodsink.cpp index 3a43e65830..5ce1a70fbc 100644 --- a/plugins/channelrx/demoddsd/dsddemodsink.cpp +++ b/plugins/channelrx/demoddsd/dsddemodsink.cpp @@ -63,7 +63,6 @@ DSDDemodSink::DSDDemodSink() : m_dsdDecoder(), m_signalFormat(signalFormatNone) { - m_audioBuffer.resize(1<<14); m_audioBufferFill = 0; m_demodBuffer.resize(1<<12); m_demodBufferFill = 0; diff --git a/plugins/channelrx/demoddsd/dsddemodsink.h b/plugins/channelrx/demoddsd/dsddemodsink.h index a9dd2780ba..31ae0d6730 100644 --- a/plugins/channelrx/demoddsd/dsddemodsink.h +++ b/plugins/channelrx/demoddsd/dsddemodsink.h @@ -140,7 +140,6 @@ class DSDDemodSink : public ChannelSampleSink { MagSqLevelsStore m_magSqLevelStore; SampleVector m_scopeSampleBuffer; - AudioVector m_audioBuffer; uint m_audioBufferFill; FixReal *m_sampleBuffer; //!< samples ring buffer int m_sampleBufferIndex; diff --git a/plugins/channelrx/demodfreedv/freedvdemodsink.cpp b/plugins/channelrx/demodfreedv/freedvdemodsink.cpp index fdbcd0422e..4379bf803b 100644 --- a/plugins/channelrx/demodfreedv/freedvdemodsink.cpp +++ b/plugins/channelrx/demodfreedv/freedvdemodsink.cpp @@ -330,10 +330,14 @@ void FreeDVDemodSink::pushSampleToAudio(int16_t sample) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("FreeDVDemodSink::pushSampleToAudio: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) { - qDebug("FreeDVDemodSink::pushSampleToAudio: %u/%u samples written", res, m_audioBufferFill); + if (res != m_audioBuffer.size()) { + qDebug("FreeDVDemodSink::pushSampleToAudio: %u/%lu samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/demodils/ilsdemodsink.cpp b/plugins/channelrx/demodils/ilsdemodsink.cpp index cbb9b629d9..b61c971ec6 100644 --- a/plugins/channelrx/demodils/ilsdemodsink.cpp +++ b/plugins/channelrx/demodils/ilsdemodsink.cpp @@ -316,11 +316,15 @@ void ILSDemodSink::processOneAudioSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("ILSDemodSink::processOneAudioSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) + if (res != m_audioBuffer.size()) { - qDebug("ILSDemodSink::processOneAudioSample: %u/%u audio samples written", res, m_audioBufferFill); + qDebug("ILSDemodSink::processOneAudioSample: %u/%lu audio samples written", res, m_audioBuffer.size()); m_audioFifo.clear(); } diff --git a/plugins/channelrx/demodm17/m17demodprocessor.cpp b/plugins/channelrx/demodm17/m17demodprocessor.cpp index 8637ca4e58..439288903d 100644 --- a/plugins/channelrx/demodm17/m17demodprocessor.cpp +++ b/plugins/channelrx/demodm17/m17demodprocessor.cpp @@ -520,10 +520,14 @@ void M17DemodProcessor::processAudio(const std::array& in) if (m_audioBufferFill >= m_audioBuffer.size() - 960) { - uint res = m_audioFifo->write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("M17DemodProcessor::processAudio: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo->write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) { - qDebug("M17DemodProcessor::processAudio: %u/%u audio samples written", res, m_audioBufferFill); + if (res != m_audioBuffer.size()) { + qDebug("M17DemodProcessor::processAudio: %u/%lu audio samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/demodm17/m17demodsink.cpp b/plugins/channelrx/demodm17/m17demodsink.cpp index 88aa0dbfd7..77e88bdf9a 100644 --- a/plugins/channelrx/demodm17/m17demodsink.cpp +++ b/plugins/channelrx/demodm17/m17demodsink.cpp @@ -59,7 +59,6 @@ M17DemodSink::M17DemodSink() : m_scopeXY(nullptr), m_scopeEnabled(true) { - m_audioBuffer.resize(1<<14); m_audioBufferFill = 0; m_demodBuffer.resize(1<<12); m_demodBufferFill = 0; diff --git a/plugins/channelrx/demodm17/m17demodsink.h b/plugins/channelrx/demodm17/m17demodsink.h index bd0bc50811..9d37f4072d 100644 --- a/plugins/channelrx/demodm17/m17demodsink.h +++ b/plugins/channelrx/demodm17/m17demodsink.h @@ -166,7 +166,6 @@ class M17DemodSink : public ChannelSampleSink { MagSqLevelsStore m_magSqLevelStore; SampleVector m_scopeSampleBuffer; - AudioVector m_audioBuffer; uint m_audioBufferFill; FixReal *m_sampleBuffer; //!< samples ring buffer int m_sampleBufferIndex; diff --git a/plugins/channelrx/demodnfm/nfmdemodsink.cpp b/plugins/channelrx/demodnfm/nfmdemodsink.cpp index 9bbd55ec47..c0b32d9f65 100644 --- a/plugins/channelrx/demodnfm/nfmdemodsink.cpp +++ b/plugins/channelrx/demodnfm/nfmdemodsink.cpp @@ -244,12 +244,16 @@ void NFMDemodSink::processOneSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("NFMDemodSink::processOneSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) + if (res != m_audioBuffer.size()) { - qDebug("NFMDemodSink::processOneSample: %u/%u audio samples written m_audioSampleRate: %u m_channelSampleRate: %d", - res, m_audioBufferFill, m_audioSampleRate, m_channelSampleRate); + qDebug("NFMDemodSink::processOneSample: %u/%lu audio samples written m_audioSampleRate: %u m_channelSampleRate: %d", + res, m_audioBuffer.size(), m_audioSampleRate, m_channelSampleRate); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/demodssb/ssbdemodsink.cpp b/plugins/channelrx/demodssb/ssbdemodsink.cpp index 389328cbab..f29429bf03 100644 --- a/plugins/channelrx/demodssb/ssbdemodsink.cpp +++ b/plugins/channelrx/demodssb/ssbdemodsink.cpp @@ -241,10 +241,14 @@ void SSBDemodSink::processOneSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("SSBDemodSink::processOneSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) { - qDebug("SSBDemodSink::processOneSample: %u/%u samples written", res, m_audioBufferFill); + if (res != m_audioBuffer.size()) { + qDebug("SSBDemodSink::processOneSample: %u/%lu samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/demodvor/vordemodsink.cpp b/plugins/channelrx/demodvor/vordemodsink.cpp index 18b9e21531..50270113ab 100644 --- a/plugins/channelrx/demodvor/vordemodsink.cpp +++ b/plugins/channelrx/demodvor/vordemodsink.cpp @@ -149,11 +149,15 @@ void VORDemodSCSink::processOneAudioSample(Complex &ci) if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("VORDemodSCSink::processOneAudioSample: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) + if (res != m_audioBuffer.size()) { - qDebug("VORDemodSCSink::processOneAudioSample: %u/%u audio samples written", res, m_audioBufferFill); + qDebug("VORDemodSCSink::processOneAudioSample: %u/%lu audio samples written", res, m_audioBuffer.size()); m_audioFifo.clear(); } diff --git a/plugins/channelrx/demodwfm/wfmdemodsink.cpp b/plugins/channelrx/demodwfm/wfmdemodsink.cpp index 2a71f81589..6595fd9e56 100644 --- a/plugins/channelrx/demodwfm/wfmdemodsink.cpp +++ b/plugins/channelrx/demodwfm/wfmdemodsink.cpp @@ -126,10 +126,14 @@ void WFMDemodSink::feed(const SampleVector::const_iterator& begin, const SampleV if(m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("WFMDemodSink::feed: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } + + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); - if (res != m_audioBufferFill) { - qDebug("WFMDemodSink::feed: %u/%u audio samples written", res, m_audioBufferFill); + if (res != m_audioBuffer.size()) { + qDebug("WFMDemodSink::feed: %u/%lu audio samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0; diff --git a/plugins/channelrx/udpsink/udpsinksink.cpp b/plugins/channelrx/udpsink/udpsinksink.cpp index d8f3eea5f1..c9c2c22982 100644 --- a/plugins/channelrx/udpsink/udpsinksink.cpp +++ b/plugins/channelrx/udpsink/udpsinksink.cpp @@ -314,10 +314,14 @@ void UDPSinkSink::audioReadyRead() if (m_audioBufferFill >= m_audioBuffer.size()) { - uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBufferFill); + if (m_audioBufferFill > m_audioBuffer.size()) { + qDebug("UDPSinkSink::audioReadyRead: dropping %d samples", (int) m_audioBufferFill - (int) m_audioBuffer.size()); + } - if (res != m_audioBufferFill) { - qDebug("UDPSinkSink::audioReadyRead: (stereo) lost %u samples", m_audioBufferFill - res); + uint res = m_audioFifo.write((const quint8*)&m_audioBuffer[0], m_audioBuffer.size()); + + if (res != m_audioBuffer.size()) { + qDebug("UDPSinkSink::audioReadyRead: %u/%lu audio samples written", res, m_audioBuffer.size()); } m_audioBufferFill = 0;