Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/audiomixerboard.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ static bool midiPickupShouldApply ( int midiValue, int currentValue, int toleran
// Handles the case where rapid movement causes MIDI values to "skip over" the software value
if ( recentMidiValues.size() >= 2 )
{
int prevMidi = recentMidiValues.back();
int prevMidi = recentMidiValues[recentMidiValues.size() - 2];

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this get out of bounds? E.g access -2?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since if ( recentMidiValues.size() >= 2 ), there shouldn't be any danger of that.

The problem raised is in fact correct and the fix looks like it's correct too. I haven't had time to test it and don't know when I will - hopefully some time next week. This bug probably went unnoticed in testing by me because I modified my controller to output the full stream of CC messages even when moving it fast.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 AI: ignotus666 got it right — the size() >= 2 guard is what prevents it, and now it's measured.

Swept with the two patched functions extracted verbatim into a driver built -fsanitize=address,undefined -D_GLIBCXX_DEBUG, which bounds-checks std::deque::operator[]: every midiValue x currentValue pair in 0..127, tolerance 0..8, ascending and descending sequences, starting from an empty buffer. 589,824 calls, buffer lengths 0, 1 and 2 all exercised, zero diagnostics. Since the buffer never exceeds MIDI_PICKUP_HISTORY (2), size() - 2 is always index 0.

The guard is load-bearing: at size() == 1, size() - 2 is unsigned and wraps to 18446744073709551615.

// Check if current and previous MIDI values bracket the software value
if ( ( prevMidi <= currentValue && midiValue >= currentValue ) || ( prevMidi >= currentValue && midiValue <= currentValue ) )
return true;
Expand All @@ -117,7 +117,11 @@ static bool midiPickupTryApply ( int midiValue, int currentValue, int tolerance,
tempPickup.push_back ( midiValue );

if ( !midiPickupShouldApply ( midiValue, currentValue, tolerance, tempPickup ) )
{
// keep this value: the next message needs it to detect a crossing
pickupBuffer = tempPickup;
return true; // Still waiting for pickup
}

// Picked up. Stop waiting
waitingForPickup = false;
Expand Down
Loading