Fix a buffer overflow (thanks to syke) and modify the way the instruments are loaded (bytes instead of uint16). This (sadly) doesn't fix the MDY player.

svn-id: r46936

1 files changed, 18 insertions, 9 deletions

diff --git a/engines/gob/sound/adlib.cpp b/engines/gob/sound/adlib.cpp
index 1f1851e387..f925fc5b47 100644
--- a/engines/gob/sound/adlib.cpp
+++ b/engines/gob/sound/adlib.cpp
@@ -132,7 +132,7 @@ int AdLib::readBuffer(int16 *buffer, const int numSamples) {
 }
 
 void AdLib::writeOPL(byte reg, byte val) {
-	debugC(6, kDebugSound, "writeOPL(%02X, %02X)", reg, val);
+	debugC(6, kDebugSound, "AdLib::writeOPL (%02X, %02X)", reg, val);
 	OPLWriteReg(_opl, reg, val);
 }
 
@@ -243,10 +243,12 @@ void AdLib::setKey(byte voice, byte note, bool on, bool spec) {
 	writeOPL(0xB0 + voice, (freq >> 8) | (octa << 2) | 0x20 * on);
 
 	if (!freq)
-		warning("AdLib: Voice %d, note %02X unknown", voice, note);
+		warning("AdLib::setKey Voice %d, note %02X unknown", voice, note);
 }
 
 void AdLib::setVolume(byte voice, byte volume) {
+	debugC(6, kDebugSound, "AdLib::setVolume(%d, %d)", voice, volume);
+	//assert(voice >= 0 && voice <= 9);
 	volume = 0x3F - ((volume * 0x7E) + 0x7F) / 0xFE;
 	writeOPL(0x40 + _volRegNums[voice], volume);
 }
@@ -513,6 +515,8 @@ bool MDYPlayer::loadMDY(Common::SeekableReadStream &stream) {
 	_nrCommand = mdyHeader[46] + (mdyHeader[47] << 8) + (mdyHeader[48] << 16) + (mdyHeader[49] << 24);
 // _soundMode is either 0 (melodic) or 1 (percussive)
 	_soundMode = mdyHeader[58];
+	assert((_soundMode == 0) || (_soundMode == 1));
+
 	_pitchBendRangeStep = 25*mdyHeader[59];
 	_basicTempo = mdyHeader[60] + (mdyHeader[61] << 8);
 
@@ -597,6 +601,7 @@ void MDYPlayer::interpret() {
 	uint8 ctrlByte1, ctrlByte2;
 	uint8 timbre;
 
+// TODO : Verify the loop for percussive mode (11 ?)
 	if (_first) {
 		for (int i = 0; i < 9; i ++)
 			setVolume(i, 0);
@@ -609,7 +614,7 @@ void MDYPlayer::interpret() {
 	}
 	do {
 		instr = *_playPos;
-//			printf("instr 0x%X\n", instr);
+		debugC(6, kDebugSound,"MDYPlayer::interpret instr 0x%X", instr);
 		switch (instr) {
 		case 0xF8:
 			_wait = *(_playPos++);
@@ -622,6 +627,7 @@ void MDYPlayer::interpret() {
 			_playPos++;
 			ctrlByte1 = *(_playPos++);
 			ctrlByte2 = *(_playPos++);
+			debugC(6, kDebugSound,"MDYPlayer::interpret ctrlBytes 0x%X 0x%X", ctrlByte1, ctrlByte2);
 			if (ctrlByte1 != 0x7F || ctrlByte2 != 0) {
 				_playPos -= 2;
 				while (*(_playPos++) != 0xF7)
@@ -721,11 +727,11 @@ void MDYPlayer::setVoices() {
 	byte *timbrePtr;
 
 	timbrePtr = _timbres;
-	debugC(6, kDebugSound, "TBR version: %X.%X", timbrePtr[0], timbrePtr[1]);
+	debugC(6, kDebugSound, "MDYPlayer::setVoices TBR version: %X.%X", timbrePtr[0], timbrePtr[1]);
 	timbrePtr += 2;
 
 	_tbrCount = READ_LE_UINT16(timbrePtr);
-	debugC(6, kDebugSound, "Timbres counter: %d", _tbrCount);
+	debugC(6, kDebugSound, "MDYPlayer::setVoices Timbres counter: %d", _tbrCount);
 	timbrePtr += 2;
 	_tbrStart = READ_LE_UINT16(timbrePtr);
 
@@ -735,7 +741,8 @@ void MDYPlayer::setVoices() {
 }
 
 void MDYPlayer::setVoice(byte voice, byte instr, bool set) {
-	uint16 strct[27];
+//	uint16 strct[27];
+	uint8 strct[27];
 	byte channel;
 	byte *timbrePtr;
 	char timbreName[10];
@@ -743,7 +750,7 @@ void MDYPlayer::setVoice(byte voice, byte instr, bool set) {
 	timbreName[9] = '\0';
 	for (int j = 0; j < 9; j++)
 		timbreName[j] = _timbres[6 + j + (instr * 9)];
-	debugC(6, kDebugSound, "Loading timbre %s", timbreName);
+	debugC(6, kDebugSound, "MDYPlayer::setVoice Loading timbre %s", timbreName);
 
 	// i = 0 :  0  1  2  3  4  5  6  7  8  9 10 11 12 26
 	// i = 1 : 13 14 15 16 17 18 19 20 21 22 23 24 25 27
@@ -755,8 +762,10 @@ void MDYPlayer::setVoice(byte voice, byte instr, bool set) {
 						(uint32) (timbrePtr - _timbres), _timbresSize);
 				strct[j] = 0;
 			} else
-				strct[j] = READ_LE_UINT16(timbrePtr);
-			timbrePtr += 2;
+				//strct[j] = READ_LE_UINT16(timbrePtr);
+				strct[j] = timbrePtr[0];
+			//timbrePtr += 2;
+			timbrePtr++;
 		}
 		channel = _operators[voice] + i * 3;
 		writeOPL(0xBD, 0x00);