[vlc-commits] coreaudio: fix play of uninitialized data (loud CRACK)

[Thomas Guillem]

vlc/vlc-3.0 | branch: master | Thomas Guillem <thomas at gllm.fr> | Thu Oct  8 12:31:20 2020 +0200| [616090514190b2918e2c5f29f9f647e0e4227723] | committer: David Fuhrmann

coreaudio: fix play of uninitialized data (loud CRACK)

When starting deferred (likely), ca_Render() is filling the output
buffer with 0s (silence) until the requested start time is reached. When
the host time is near the requested start time, the output buffer is
partially filled with 0s, and partially filled with valid data.

In that particular case, the output buffer offset was not updated
causing the valid data to be copied at the beginning of the output
buffer, leaving some uninitialized data at the end of the buffer.

Fixes #25142

Signed-off-by: Marvin Scholz <epirat07 at gmail.com>
(cherry picked from commit 61037b63695182fc2031614ef554d000ce5c9a0d)
Signed-off-by: David Fuhrmann <dfuhrmann at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=616090514190b2918e2c5f29f9f647e0e4227723
---

 modules/audio_output/coreaudio_common.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/modules/audio_output/coreaudio_common.c b/modules/audio_output/coreaudio_common.c
index de3a9717a7..418226468f 100644
--- a/modules/audio_output/coreaudio_common.c
+++ b/modules/audio_output/coreaudio_common.c
@@ -191,6 +191,7 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
         memset(p_output, 0, i_silence_bytes);
 
         i_requested -= i_silence_bytes;
+        p_output += i_silence_bytes;
 
         /* Start the first rendering */
     }
@@ -203,9 +204,11 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
     while (p_block != NULL && i_requested != 0)
     {
         size_t i_tocopy = __MIN(i_requested, p_block->i_buffer);
-        memcpy(&p_output[i_copied], p_block->p_buffer, i_tocopy);
+        memcpy(p_output, p_block->p_buffer, i_tocopy);
         i_requested -= i_tocopy;
         i_copied += i_tocopy;
+        p_output += i_tocopy;
+
         if (i_tocopy == p_block->i_buffer)
         {
             block_t *p_release = p_block;
@@ -230,7 +233,7 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
     {
         assert(p_sys->i_out_size == 0);
         p_sys->i_underrun_size += i_requested;
-        memset(&p_output[i_copied], 0, i_requested);
+        memset(p_output, 0, i_requested);
     }
 
     lock_unlock(p_sys);