The previous fix for this bug was incorrect; it only happened
to work because of another bug: the number of exports was being
read incorrectly (reading the byte size of the export block, not
the number of exports), so the validation check for the export
number always passed. Then, the "small" offsets that were seen
were actually either invalid reads into the header of the next
block in the script (KQ4), or reads into the bad first export
table which contained an unfilled offset (Camelot).
Once the incorrect number of exports was fixed, the previous "fix"
broke in KQ4 because the export number validation started to work
correctly and the first export table does not have enough entries
(needs 2, has 1).
This patch fixes the bug by using the last export table in SCI0
scripts instead of the first export table. (This does not affect
most scripts, since only the buggy scripts have more than one
export table.)
Fixes Trac#9731.
1. KQ4 sound 104 has an extra 0xFC (MIDI Stop command/kEndOfTrack)
at the end of the resource, which causes an out-of-bounds read
because the filtering loop continues after the first 0xFC and
unconditionally attempts to read 2 bytes (expecting there to
always be a delta value + a command, whereas in this file there
is only another kEndOfTrack command). This is corrected by
exiting the filtering loop when a kEndOfTrack is encountered
and there is not enough data remaining in the resource to
continue reading.
2. KQ5 sound 699 is truncated, which causes the parser to attempt
to read past the end of the resource. This is addressed by
adding bounds checks that exit the mix loop early if there is
no more data available to read. This allows truncated sounds
to be played as far as possible (previously, trying to read
truncated resources would result in a fatal error).
3. midiMixChannels allocates an arbitrary amount of raw memory
for the mixed MIDI sequence, without performing any bounds
checking when writing to this memory, potentially leading to
a crash or silent corruption of adjacent memory. This is
mitigated by using SciSpan instead of a raw pointer for the
mixed data.
Fixes Trac#9727.
Colin Snover
Torbjörn Andersson
Eugene Sandulenko
Paul Gilbert
Bastien Bouclet
Lothar Serra Mari
Thierry Crozat
D G Turner
stevenhoefel
Paolo Bossi
pablobecerra
George Kormendi
Peter Kohaut
Ben Castricum