mirror of
https://github.com/AsahiLinux/u-boot
synced 2024-12-23 11:33:32 +00:00
49209da54f
Data is written for each channel but is only tracked as having one
channel written. This resulted in a buffer overflow and corruption of
the allocator's metadata which caused further problems when the buffer
was later freed. This could be observed with sandbox unit tests.
Resolve the overflow by tracking the writes for each channel.
Fixes: f987177db9 ("dm: sound: Use the correct number of channels for sound")
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
36 lines
825 B
C
36 lines
825 B
C
// SPDX-License-Identifier: GPL-2.0+
|
|
/*
|
|
* Copyright (C) 2012 Samsung Electronics
|
|
* R. Chandrasekar <rcsekar@samsung.com>
|
|
*/
|
|
|
|
#include <common.h>
|
|
#include <log.h>
|
|
#include <sound.h>
|
|
|
|
void sound_create_square_wave(uint sample_rate, unsigned short *data, int size,
|
|
uint freq, uint channels)
|
|
{
|
|
const unsigned short amplitude = 16000; /* between 1 and 32767 */
|
|
const int period = freq ? sample_rate / freq : 0;
|
|
const int half = period / 2;
|
|
|
|
assert(freq);
|
|
|
|
/* Make sure we don't overflow our buffer */
|
|
if (size % 2)
|
|
size--;
|
|
|
|
while (size) {
|
|
int i, j;
|
|
|
|
for (i = 0; size && i < half; i++) {
|
|
for (j = 0; size && j < channels; j++, size -= 2)
|
|
*data++ = amplitude;
|
|
}
|
|
for (i = 0; size && i < period - half; i++) {
|
|
for (j = 0; size && j < channels; j++, size -= 2)
|
|
*data++ = -amplitude;
|
|
}
|
|
}
|
|
}
|