Changeset 2730

01/11/18 17:59:30 (1 week ago)

RME: fix output fader array overflow.

Human readable output fader volumes are stored in the device setting's
output_faders array. The RME hardware flash interface requires derived
values, which are generated and stored in a separate buffer when needed.
This buffer has 32 elements. The last two elements are not fader values,
but a flag to indicate that MIDI is active (element 30) and a submix number
(element 31). It is suspected that these are for the convience of computer
software and are not used by the RME hardware. FFADO does not make use of
either element. As a result, only 30 fader values were copied between the
flash buffer and the output_faders array. However, this creates a buffer
overflow in the output_faders array, since this is defined to have
RME_FF800_MAX_CHANNELS elements, and RME_FF800_MAX_CHANNELS is 28.

The fix is to use the local "nch" variable as the upper bound on the value
conversion loop rather than a fixed value of 30. Unused flash buffer
elements will be unread or unwritten, which is acceptable since the relevant
flash buffer and fader arrays are always zeroed before use.

This issue was flagged by a QA warning in Gentoo and reported to the
ffado-devel mailing list by Hector Martin, along with the suggested fix.



  • trunk/libffado/src/rme/fireface_flash.cpp

    r2651 r2730  
    609609    // It's suspected that neither of these are used by the device directly, 
    610610    // and that these elements are just a convenient place for computer 
    611     // control applications to store things. 
    612     for (out=0; out<30; out++) { 
     611    // control applications to store things.  FFADO does not make use 
     612    // of these.  nch is assumed to be <= RME_FF800_MAX_CHANNELS (28), 
     613    // the size of the output_faders[] array. 
     614    for (out=0; out<nch; out++) { 
    613615      dsettings->output_faders[out] = flashvol2fader(obuf[out]); 
    614616    } 
    689691    // comments in read_device_mixer_settings(). 
    690692    memset(obuf, 0, sizeof(obuf)); 
    691     for (out=0; out<30; out++) { 
     693    for (out=0; out<nch; out++) { 
    692694      obuf[out] = fader2flashvol(dsettings->output_faders[out]); 
    693695    }