vwemirror/BT411
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Death-crash FIXED: 25-voice explosion preset overflowed the 5-slot audio SourceSet (Gitea #12)

Browse Source 
The weekend's crash family root-caused under cdb: SourceSet.sources[5]
receives the AllExplosion death preset's 25 streamed voices --
RequestAudioChannels wrote 20 OpenAL source ids past the array, smashing
the neighbouring heap object (Release: a vtable overwritten with a source
id -> delayed silent AV at AudioControlEvent::Send; Debug: CRT heap-
corruption abort in the death Explosion's audio teardown).  Explains all
three #12 crash flavors (solo enemy kill -- stack-confirmed; MP self-
death; MP peer PEER_DOWN cascade -- same generic teardown).

Fix: sources[] sized to AUDIO_SOURCESET_CAPACITY=25, static_assert
lockstep with MAX_PRESET_SAMPLES, + defence-in-depth clamps at the ctor
and acquisition sites.  Soak: 26+ deaths across glass AND pod builds
under cdb, zero faults, full wreck lifecycle every time.  Gotchas S21:
the fixed-array-vs-streamed-count overflow class + sweep note.

Awaiting human verification: the MP death-and-survive session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
arcattack
2026-07-20 14:51:35 -05:00
co-authored by Claude Fable 5
parent 6ad1e074cc
commit a0cec48e3f
5 changed files with 90 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
engine/MUNGA_L4/L4AUDIO.cpp
+14 -1
View File
@@ -672,7 +672,20 @@ L4AudioSource::L4AudioSource(
):
AudioSource(stream, entity)
{
channelSet.count = GetAudioVoiceCount();
// Gitea #12: never let the voice count exceed the SourceSet capacity -- a
// malformed/oversized preset stream would otherwise overflow sources[] on
// channel acquisition and corrupt the heap (the death-crash class). The
// array is now sized to the largest legitimate preset (AUDIO_SOURCESET_
// CAPACITY == MAX_PRESET_SAMPLES), so this clamp is defence-in-depth.
int voices = GetAudioVoiceCount();
if (voices > AUDIO_SOURCESET_CAPACITY)
{
DEBUG_STREAM << "[audio] WARNING: voiceCount " << voices
<< " exceeds SourceSet capacity " << AUDIO_SOURCESET_CAPACITY
<< " -- clamped (Gitea #12)\n" << std::flush;
voices = AUDIO_SOURCESET_CAPACITY;
}
channelSet.count = voices;
L4AudioSourceX();
}