From d3d0e434140c7ea24746f4b4684f90861d722753 Mon Sep 17 00:00:00 2001
From: Sergeanur <s.anureev@yandex.ua>
Date: Mon, 6 Sep 2021 17:43:52 +0300
Subject: [PATCH] Prevent possible tempStereoBuffer overflow

---
 src/audio/oal/channel.cpp   | 6 +++++-
 src/audio/sampman_miles.cpp | 1 +
 src/audio/sampman_oal.cpp   | 5 +++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/audio/oal/channel.cpp b/src/audio/oal/channel.cpp
index 04e7e529..adda05cb 100644
--- a/src/audio/oal/channel.cpp
+++ b/src/audio/oal/channel.cpp
@@ -9,6 +9,7 @@
 #endif
 
 extern bool IsFXSupported();
+extern size_t gPlayerTalkDataSize;
 
 ALuint alSources[NUM_CHANNELS];
 ALuint alFilters[NUM_CHANNELS];
@@ -17,7 +18,7 @@ bool bChannelsCreated = false;
 
 int32 CChannel::channelsThatNeedService = 0;
 
-uint8 tempStereoBuffer[PED_BLOCKSIZE * 2];
+uint8* tempStereoBuffer = nil;
 
 void
 CChannel::InitChannels()
@@ -26,6 +27,8 @@ CChannel::InitChannels()
 	alGenBuffers(NUM_CHANNELS, alBuffers);
 	if (IsFXSupported())
 		alGenFilters(NUM_CHANNELS, alFilters);
+
+	tempStereoBuffer = new uint8[Max(PED_BLOCKSIZE, gPlayerTalkDataSize) * 2];
 	bChannelsCreated = true;
 }
 
@@ -43,6 +46,7 @@ CChannel::DestroyChannels()
 			alDeleteFilters(NUM_CHANNELS, alFilters);
 			memset(alFilters, 0, sizeof(alFilters));
 		}
+		delete[]tempStereoBuffer;
 		bChannelsCreated = false;
 	}
 }
diff --git a/src/audio/sampman_miles.cpp b/src/audio/sampman_miles.cpp
index 9f8e8a9c..b031915d 100644
--- a/src/audio/sampman_miles.cpp
+++ b/src/audio/sampman_miles.cpp
@@ -1444,6 +1444,7 @@ cSampleManager::Terminate(void)
 	{
 		AIL_mem_free_lock(gPlayerTalkData);
 		gPlayerTalkData = 0;
+		gPlayerTalkSfx = UINT32_MAX;
 	}
 #endif
 	
diff --git a/src/audio/sampman_oal.cpp b/src/audio/sampman_oal.cpp
index 9cf30832..6fce3a8b 100644
--- a/src/audio/sampman_oal.cpp
+++ b/src/audio/sampman_oal.cpp
@@ -105,6 +105,7 @@ uint8 nCurrentPedSlot;
 #ifdef FIX_BUGS
 uint32 gPlayerTalkSfx = UINT32_MAX;
 void *gPlayerTalkData = 0;
+size_t gPlayerTalkDataSize = 0;
 #endif
 
 CChannel aChannel[NUM_CHANNELS];
@@ -977,6 +978,8 @@ cSampleManager::Initialise(void)
 
 		gPlayerTalkData = malloc(nMaxPedSize);
 		ASSERT(gPlayerTalkData != 0);
+
+		gPlayerTalkDataSize = nMaxPedSize;
 #endif
 
 		LoadSampleBank(SFX_BANK_0);
@@ -1144,6 +1147,8 @@ cSampleManager::Terminate(void)
 	{
 		free(gPlayerTalkData);
 		gPlayerTalkData = 0;
+		gPlayerTalkDataSize = 0;
+		gPlayerTalkSfx = UINT32_MAX;
 	}
 #endif