diff options
author | Qt Continuous Integration System <qt-info@nokia.com> | 2010-11-10 14:06:15 (GMT) |
---|---|---|
committer | Qt Continuous Integration System <qt-info@nokia.com> | 2010-11-10 14:06:15 (GMT) |
commit | 8b43b9e63374f0b83ec15c909a382da173344ca8 (patch) | |
tree | 36d4ec607573138c518c4b75a5e5562796126315 /src | |
parent | 9bc46788f3b0f4a652be604d3facbcd84602677a (diff) | |
parent | e3f1268e63064a54215051cf91d5f6b8c8bd4f0f (diff) | |
download | Qt-8b43b9e63374f0b83ec15c909a382da173344ca8.zip Qt-8b43b9e63374f0b83ec15c909a382da173344ca8.tar.gz Qt-8b43b9e63374f0b83ec15c909a382da173344ca8.tar.bz2 |
Merge branch '4.7' of scm.dev.nokia.troll.no:qt/qt-multimedia-staging into 4.7-integration
* '4.7' of scm.dev.nokia.troll.no:qt/qt-multimedia-staging:
Fix potential buffer overrun in ALSA QAudioInput implementation.
Fix potential buffer overrun in QAudioInput windows implementation.
Diffstat (limited to 'src')
-rw-r--r-- | src/multimedia/audio/qaudioinput_alsa_p.cpp | 21 | ||||
-rw-r--r-- | src/multimedia/audio/qaudioinput_win32_p.cpp | 11 |
2 files changed, 19 insertions, 13 deletions
diff --git a/src/multimedia/audio/qaudioinput_alsa_p.cpp b/src/multimedia/audio/qaudioinput_alsa_p.cpp index ddafa3d..5265915 100644 --- a/src/multimedia/audio/qaudioinput_alsa_p.cpp +++ b/src/multimedia/audio/qaudioinput_alsa_p.cpp @@ -482,19 +482,18 @@ int QAudioInputPrivate::bytesReady() const qint64 QAudioInputPrivate::read(char* data, qint64 len) { - Q_UNUSED(len) - // Read in some audio data and write it to QIODevice, pull mode if ( !handle ) return 0; - bytesAvailable = checkBytesReady(); + // bytesAvaiable is saved as a side effect of checkBytesReady(). + int bytesToRead = checkBytesReady(); - if (bytesAvailable < 0) { + if (bytesToRead < 0) { // bytesAvailable as negative is error code, try to recover from it. - xrun_recovery(bytesAvailable); - bytesAvailable = checkBytesReady(); - if (bytesAvailable < 0) { + xrun_recovery(bytesToRead); + bytesToRead = checkBytesReady(); + if (bytesToRead < 0) { // recovery failed must stop and set error. close(); errorState = QAudio::IOError; @@ -504,9 +503,11 @@ qint64 QAudioInputPrivate::read(char* data, qint64 len) } } + bytesToRead = qMin<qint64>(len, bytesToRead); + bytesToRead -= bytesToRead % period_size; int count=0, err = 0; while(count < 5) { - int chunks = bytesAvailable/period_size; + int chunks = bytesToRead/period_size; int frames = chunks*period_frames; if(frames > (int)buffer_frames) frames = buffer_frames; @@ -554,6 +555,7 @@ qint64 QAudioInputPrivate::read(char* data, qint64 len) emit stateChanged(deviceState); } } else { + bytesAvailable -= err; totalTimeValue += err; resuming = false; if (deviceState != QAudio::ActiveState) { @@ -566,6 +568,7 @@ qint64 QAudioInputPrivate::read(char* data, qint64 len) } else { memcpy(data,audioBuffer,err); + bytesAvailable -= err; totalTimeValue += err; resuming = false; if (deviceState != QAudio::ActiveState) { @@ -661,7 +664,7 @@ bool QAudioInputPrivate::deviceReady() { if(pullMode) { // reads some audio data and writes it to QIODevice - read(0,0); + read(0, buffer_size); } else { // emits readyRead() so user will call read() on QIODevice to get some audio data InputPrivate* a = qobject_cast<InputPrivate*>(audioSource); diff --git a/src/multimedia/audio/qaudioinput_win32_p.cpp b/src/multimedia/audio/qaudioinput_win32_p.cpp index 1cde159..0ec2492 100644 --- a/src/multimedia/audio/qaudioinput_win32_p.cpp +++ b/src/multimedia/audio/qaudioinput_win32_p.cpp @@ -400,9 +400,12 @@ qint64 QAudioInputPrivate::read(char* data, qint64 len) resuming = false; } } else { + l = qMin<qint64>(len, waveBlocks[header].dwBytesRecorded); // push mode - memcpy(p,waveBlocks[header].lpData,waveBlocks[header].dwBytesRecorded); - l = waveBlocks[header].dwBytesRecorded; + memcpy(p, waveBlocks[header].lpData, l); + + len -= l; + #ifdef DEBUG_AUDIO qDebug()<<"IN: "<<waveBlocks[header].dwBytesRecorded<<", OUT: "<<l; #endif @@ -457,7 +460,7 @@ qint64 QAudioInputPrivate::read(char* data, qint64 len) mutex.lock(); if(!pullMode) { - if(l+period_size > len && waveFreeBlockCount == buffer_size/period_size) + if(len < period_size || waveFreeBlockCount == buffer_size/period_size) done = true; } else { if(waveFreeBlockCount == buffer_size/period_size) @@ -568,7 +571,7 @@ bool QAudioInputPrivate::deviceReady() if(pullMode) { // reads some audio data and writes it to QIODevice - read(0,0); + read(0, buffer_size); } else { // emits readyRead() so user will call read() on QIODevice to get some audio data InputPrivate* a = qobject_cast<InputPrivate*>(audioSource); |