jens/JaySynth
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix VCF coefficient buffer undersized for 4th-order filters

Browse Source 
Found while building tools/testhost's regression suite for the
Critical #5 block-size fix: VCF_CalcCoeff_LPF/_HPF/_BPF advance the
coefficient pointer once per (sample, filter-section) pair, but a
4th-order filter uses FILTER_MAX_ORDER/2 = 2 cascaded 2nd-order
sections per sample. VCF_SetBufsize only allocated pCoef with bufsize
entries, not bufsize*sections, so any host block between 4097 and
8192 samples with a 4th-order filter selected wrote past the
allocation.

Confirmed with AddressSanitizer before the fix: heap-buffer-overflow,
WRITE of size 8, exactly 8 bytes past a 393216-byte (8192 x
sizeof(vcf_coef_t)) allocation. Fixed by sizing pCoef for the worst
case. Re-verified with ASan across blockSize 4097/8192/16384/20000 -
zero errors after the fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011dhtwRLARk4eiPngcQykLJ
This commit is contained in:
jens
2026-07-27 20:02:04 +02:00
co-authored by Claude Sonnet 5
parent cee75c523b
commit d713ca50bb
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/synth/vcf.c
+5 -1
View File
@@ -142,7 +142,11 @@ void VCF_SetBufsize(vcf_t *pObj, UINT32 size)
return;
pObj->pOut = (synth_float_t*)SynthCheckAlloc(malloc(pObj->bufsize*sizeof(synth_float_t)));
pObj->pCoef = (vcf_coef_t*)SynthCheckAlloc(malloc(pObj->bufsize*sizeof(vcf_coef_t)));
// VCF_CalcCoeff_*() advances the coefficient pointer once per
// (sample, filter-section) pair - a 4th-order filter uses
// FILTER_MAX_ORDER/2 cascaded 2nd-order sections per sample, so the
// buffer needs that many times bufsize entries, not just bufsize.
pObj->pCoef = (vcf_coef_t*)SynthCheckAlloc(malloc(pObj->bufsize*(FILTER_MAX_ORDER/2)*sizeof(vcf_coef_t)));
pObj->pCoeff_last = pObj->pCoef;
VCF_Coeff_update(pObj);