Opened 4 years ago
Closed 4 years ago
#11547 closed defect (fixed)
CINE: FW: Game crashes during intro with MT-32 music
Reported by: | eriktorbjorn | Owned by: | karisal |
---|---|---|---|
Priority: | normal | Component: | Engine: Cine |
Version: | Keywords: | ||
Cc: | Game: | Future Wars |
Description
Playing the DOS non-CD version of Future Wars with MT-32 emulation, the game crashes during the intro when the bucket falls over. This is the final readable part of the backtrace:
#7 0x00005555582e2d3e in SdlMutexManager::unlockMutex(OpaqueMutex*) (this=0x0, mutex=0xffffffff5a6eb960) at backends/mutex/sdl/sdl-mutex.cpp:40 #8 0x00005555560edbef in Cine::MidiSoundDriverH32::playSample(unsigned char const*, int, int, int) (this=0x55555a6eb930, data=0x55555b141cd0 "\200seau__75 \b\b\017", size=0, channel=0, volume=80) at engines/cine/sound.cpp:771 #9 0x00005555560ef878 in Cine::PCSound::playSound(int, int, unsigned char const*, int, int, int, int, int) (this=0x55555a6c7830, channel=0, frequency=0, data=0x55555b141cd0 "\200seau__75 \b\b\017", size=0, volumeStep=0, stepCount=0, volume=50, repeat=0) at engines/cine/sound.cpp:1334 #10 0x00005555560cb6b6 in Cine::FWScript::o1_playSample() (this=0x55555b148cc0) at engines/cine/script_fw.cpp:1905
The culprit seems to be this bit in o1_playSample():
if (size == 0xFFFF) { g_sound->playSound(channel, 0, data, 0, 0, 0, volume, 0); } else {
I don't know what the purpose of this is, playing a 0-byte sound effect at 0 Hz, but when it gets to MidiSoundDriverH32::playSample() it subtracts 1 from size before passing it on to writeInstrument(). There it uses MIN(246, size) for copySize, getting -1, which is then passed as the size parameter to memcpy(). That parameter is a size_t, which is apparently unsigned. When -1 is cast to unsigned it becomes something very large instead. Much larger than the 254-byte buffer it's copying to.
Change History (3)
comment:1 by , 4 years ago
Owner: | set to |
---|---|
Resolution: | → pending |
Status: | new → pending |
comment:3 by , 4 years ago
Resolution: | pending → fixed |
---|---|
Status: | pending → closed |
Confirmed.