1. KQ4 sound 104 has an extra 0xFC (MIDI Stop command/kEndOfTrack)
at the end of the resource, which causes an out-of-bounds read
because the filtering loop continues after the first 0xFC and
unconditionally attempts to read 2 bytes (expecting there to
always be a delta value + a command, whereas in this file there
is only another kEndOfTrack command). This is corrected by
exiting the filtering loop when a kEndOfTrack is encountered
and there is not enough data remaining in the resource to
continue reading.
2. KQ5 sound 699 is truncated, which causes the parser to attempt
to read past the end of the resource. This is addressed by
adding bounds checks that exit the mix loop early if there is
no more data available to read. This allows truncated sounds
to be played as far as possible (previously, trying to read
truncated resources would result in a fatal error).
3. midiMixChannels allocates an arbitrary amount of raw memory
for the mixed MIDI sequence, without performing any bounds
checking when writing to this memory, potentially leading to
a crash or silent corruption of adjacent memory. This is
mitigated by using SciSpan instead of a raw pointer for the
mixed data.
Fixes Trac#9727.
add workaround for eq2
the issue is known, but can't be properly fixed without rewriting the midiparser into a channel specific parser
previous commit caused issues in kq5/french and others
we start at offset 10 for sound SCI1 games. This is hardcoded in the interpreter. Also removing not handling signals on tick 0. This fixes Eco Quest 2 / Gonzales dancing in room 530. Thanks to wjp for the help.
We now do the jumpToTick() for hold events after waiting for the delta
of the current event, like we do for the signal set events. This keeps
the fixes for the hold timings in QFG3, while not breaking LSL6.
Many thanks to wjp for pinpointing the actual cause of the issue.
Colin Snover
Johannes Schickel
Alyssa Milburn
Willem Jan Palenstijn
Martin Kiewitz
Filippos Karapetis
strangerke
Max Horn
