From 174fe185ec8b05a1dc6ce8c49ffc5a0aa1c81855 Mon Sep 17 00:00:00 2001
From: Simon Howard
Date: Thu, 10 Apr 2014 00:20:06 -0400
Subject: sound: Fix crash with large values of snd_channels.

Sanity check the handles passed to the i_sdlsound.c API functions and
ignore requests that involve channel numbers higher than 15. This
fixes a crash if the user sets the snd_channels config variable is set
to a high value. This fixes #149 (thanks Alexandre Xavier).
---
 src/i_sdlsound.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/i_sdlsound.c b/src/i_sdlsound.c
index 2a1d83bc..5cacbc1e 100644
--- a/src/i_sdlsound.c
+++ b/src/i_sdlsound.c
@@ -826,7 +826,7 @@ static void I_SDL_UpdateSoundParams(int handle, int vol, int sep)
 {
     int left, right;
 
-    if (!sound_initialized)
+    if (!sound_initialized || handle < 0 || handle >= NUM_CHANNELS)
     {
         return;
     }
@@ -869,7 +869,7 @@ static int I_SDL_StartSound(sfxinfo_t *sfxinfo, int channel, int vol, int sep)
 {
     allocated_sound_t *snd;
 
-    if (!sound_initialized)
+    if (!sound_initialized || channel < 0 || channel >= NUM_CHANNELS)
     {
         return -1;
     }
@@ -901,9 +901,9 @@ static int I_SDL_StartSound(sfxinfo_t *sfxinfo, int channel, int vol, int sep)
     return channel;
 }
 
-static void I_SDL_StopSound (int handle)
+static void I_SDL_StopSound(int handle)
 {
-    if (!sound_initialized)
+    if (!sound_initialized || handle < 0 || handle >= NUM_CHANNELS)
     {
         return;
     }
@@ -919,7 +919,7 @@ static void I_SDL_StopSound (int handle)
 
 static boolean I_SDL_SoundIsPlaying(int handle)
 {
-    if (handle < 0)
+    if (!sound_initialized || handle < 0 || handle >= NUM_CHANNELS)
     {
         return false;
     }
-- 
cgit v1.2.3