Fix reverb buffer-overrun issue

Add code to check the upper limit of the index.  TiMidity++ to buffer-
overrun when the value of the reverb_status_gs.character was a 6 or 7.
info->index is set to a value out of range when the value of the
"Reverb Time" was -64.

Signed-off-by: yta <yta@inter7.jp>

diff --git a/timidity/reverb.c b/timidity/reverb.c
index 2d3ac4d..18cdffd 100644 (file)
--- a/timidity/reverb.c
+++ b/timidity/reverb.c
@@ -1600,6 +1600,9 @@ static void init_ch_reverb_delay(InfoDelay3 *info)
        set_delay(&(info->delayL), x);
        set_delay(&(info->delayR), x);
        info->index[0] = x - info->size[0];
+       if (info->index[0] >= info->size[0]) {
+               info->index[0] = (info->size[0] == 0) ? 0 : info->size[0] - 1;
+       }
        info->level[0] = (double)reverb_status_gs.level * 1.82 / 127.0;
        info->feedback = sqrt((double)reverb_status_gs.delay_feedback / 127.0) * 0.98;
        info->leveli[0] = TIM_FSCALE(info->level[0], 24);