[vlc-devel] [PATCH] coreaudio: fix play of uninitialized data (loud CRACK)

[Thomas Guillem]

When starting deferred (likely), ca_Render() is filling the output
buffer with 0s (silence) until the requested start time is reached. When
the host time is near the requested start time, the output buffer is
partially filled with 0s, and partially filled with valid data.

In that particular case, the output buffer offset was not updated
causing the valid data to be copied at the beginning of the output
buffer, leaving some uninitialized data at the end of the buffer.

Fixes #25142
---
 modules/audio_output/coreaudio_common.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/audio_output/coreaudio_common.c b/modules/audio_output/coreaudio_common.c
index ac4ff53c50c..4761072a296 100644
--- a/modules/audio_output/coreaudio_common.c
+++ b/modules/audio_output/coreaudio_common.c
@@ -129,6 +129,7 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
           uint8_t *p_output, size_t i_requested)
 {
     struct aout_sys_common *p_sys = (struct aout_sys_common *) p_aout->sys;
+    size_t i_copied = 0;
 
     lock_lock(p_sys);
 
@@ -173,9 +174,10 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
         const size_t i_silence_bytes =
             FramesToBytes(p_sys, UsToFrames(p_sys, i_silence_us));
         assert(i_silence_bytes <= i_requested);
-        memset(p_output, 0, i_silence_bytes);
+        memset(&p_output[i_copied], 0, i_silence_bytes);
 
         i_requested -= i_silence_bytes;
+        i_copied += i_silence_bytes;
 
         /* Start the first rendering */
     }
@@ -183,7 +185,6 @@ ca_Render(audio_output_t *p_aout, uint32_t i_frames, uint64_t i_host_time,
     p_sys->i_render_host_time = i_host_time;
     p_sys->i_render_frames = i_frames;
 
-    size_t i_copied = 0;
     block_t *p_block = p_sys->p_out_chain;
     while (p_block != NULL && i_requested != 0)
     {
-- 
2.28.0