From afa54072a9622d7a370846bf280016843dc61009 Mon Sep 17 00:00:00 2001
From: athrxx
Date: Sun, 26 Jan 2014 22:42:13 +0100
Subject: AUDIO: fix invalid mem access in midiparser.cpp

(this caused a crash in MI2)
---
 audio/midiparser.cpp | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

(limited to 'audio/midiparser.cpp')

diff --git a/audio/midiparser.cpp b/audio/midiparser.cpp
index 2454575413..6840cfcbad 100644
--- a/audio/midiparser.cpp
+++ b/audio/midiparser.cpp
@@ -214,6 +214,21 @@ void MidiParser::onTimer() {
 				activeNote(info.channel(), info.basic.param1, true);
 		}
 
+		if (info.event == 0xFF && info.ext.type == 0x2F) {
+			// End of Track must be processed by us, as well as sending it to the output device.
+			// It must be processed here instead of inside processEvent() to avoid invalid mem access,
+			// since Player::metaEvent() in SCUMM will delete the parser object.
+			if (_autoLoop) {
+				jumpToTick(0);
+				parseNextEvent(_nextEvent);
+			} else {
+				stopPlaying();
+				_driver->metaEvent(info.ext.type, info.ext.data, (uint16)info.length);
+			}
+			return;
+			
+		}
+
 		processEvent(info);
 
 		if (_abortParse)
@@ -240,21 +255,7 @@ void MidiParser::processEvent(const EventInfo &info, bool fireEvents) {
 				_driver->sysEx(info.ext.data, (uint16)info.length);
 		}
 	} else if (info.event == 0xFF) {
-		// META event
-		if (info.ext.type == 0x2F) {
-			// End of Track must be processed by us,
-			// as well as sending it to the output device.
-			if (_autoLoop) {
-				jumpToTick(0);
-				parseNextEvent(_nextEvent);
-			} else {
-				stopPlaying();
-				if (fireEvents)
-					_driver->metaEvent(info.ext.type, info.ext.data, (uint16)info.length);
-			}
-			_abortParse = true;
-			return;
-		} else if (info.ext.type == 0x51) {
+		if (info.ext.type == 0x51) {
 			if (info.length >= 3) {
 				setTempo(info.ext.data[0] << 16 | info.ext.data[1] << 8 | info.ext.data[2]);
 			}
-- 
cgit v1.2.3