On 12/23/18 9:52 PM, Kővágó, Zoltán wrote:
> With stereo playback, they need about 375 minutes of continuous audio
> playback to overflow, which is usually not a problem (as stopping and
> later resuming playback resets the counters).  But with 7.1 audio, they
> only need about 95 minutes to overflow.
> 
> After the overflow, the buf->prod % USBAUDIO_PACKET_SIZE(channels)
> assertion no longer holds true, which will result in overflowing the
> buffer.  With 64 bit variables, it would take about 762000 years to
> overflow.
> 
> Signed-off-by: Kővágó, Zoltán <dirty.ice...@gmail.com>
> ---
>  hw/usb/dev-audio.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
> index 29475a2b70..45ffc3ebb3 100644
> --- a/hw/usb/dev-audio.c
> +++ b/hw/usb/dev-audio.c
> @@ -577,9 +577,9 @@ static const USBDesc desc_audio_multi = {
>  
>  struct streambuf {
>      uint8_t *data;
> -    uint32_t size;
> -    uint32_t prod;
> -    uint32_t cons;
> +    size_t size;
> +    uint64_t prod;
> +    uint64_t cons;

OK.

>  };
>  
>  static void streambuf_init(struct streambuf *buf, uint32_t size,
> @@ -600,12 +600,14 @@ static void streambuf_fini(struct streambuf *buf)
>  
>  static int streambuf_put(struct streambuf *buf, USBPacket *p, uint32_t 
> channels)
>  {
> -    uint32_t free = buf->size - (buf->prod - buf->cons);
> +    uint64_t free = buf->size - (buf->prod - buf->cons);

I'd use ssize_t here.

>  
>      if (free < USBAUDIO_PACKET_SIZE(channels)) {
>          return 0;
>      }
>  
> +    /* can happen if prod overflows */
> +    assert(buf->prod % USBAUDIO_PACKET_SIZE(channels) == 0);
>      usb_packet_copy(p, buf->data + (buf->prod % buf->size),
>                      USBAUDIO_PACKET_SIZE(channels));
>      buf->prod += USBAUDIO_PACKET_SIZE(channels);
> @@ -614,7 +616,7 @@ static int streambuf_put(struct streambuf *buf, USBPacket 
> *p, uint32_t channels)
>  
>  static uint8_t *streambuf_get(struct streambuf *buf, size_t *len)
>  {
> -    uint32_t used = buf->prod - buf->cons;
> +    uint64_t used = buf->prod - buf->cons;
>      uint8_t *data;
>  
>      if (!used) {

Eventually here:

    ssize_t used = buf->prod - buf->cons;

    if (used <= 0) {
        return NULL;
    }

Reply via email to