Merge pull request #26505 from marcelofg55/input_buffer_crashfix

Fix possible crash on AudioDriver::input_buffer_write

2 files changed, 13 insertions, 7 deletions

diff --git a/servers/audio/audio_stream.cpp b/servers/audio/audio_stream.cpp
index a6c262d10f..1a6430c499 100644
--- a/servers/audio/audio_stream.cpp
+++ b/servers/audio/audio_stream.cpp
@@ -150,7 +150,7 @@ void AudioStreamPlaybackMicrophone::_mix_internal(AudioFrame *p_buffer, int p_fr
 		input_ofs = 0;
 	} else {
 		for (int i = 0; i < p_frames; i++) {
-			if (input_size > input_ofs) {
+			if (input_size > input_ofs && (int)input_ofs < buf.size()) {
 				float l = (buf[input_ofs++] >> 16) / 32768.f;
 				if ((int)input_ofs >= buf.size()) {
 					input_ofs = 0;
diff --git a/servers/audio_server.cpp b/servers/audio_server.cpp
index df6218ac79..14c555ab5b 100644
--- a/servers/audio_server.cpp
+++ b/servers/audio_server.cpp
@@ -90,12 +90,16 @@ void AudioDriver::input_buffer_init(int driver_buffer_frames) {
 
 void AudioDriver::input_buffer_write(int32_t sample) {
 
-	input_buffer.write[input_position++] = sample;
-	if ((int)input_position >= input_buffer.size()) {
-		input_position = 0;
-	}
-	if ((int)input_size < input_buffer.size()) {
-		input_size++;
+	if ((int)input_position < input_buffer.size()) {
+		input_buffer.write[input_position++] = sample;
+		if ((int)input_position >= input_buffer.size()) {
+			input_position = 0;
+		}
+		if ((int)input_size < input_buffer.size()) {
+			input_size++;
+		}
+	} else {
+		WARN_PRINTS("input_buffer_write: Invalid input_position=" + itos(input_position) + " input_buffer.size()=" + itos(input_buffer.size()));
 	}
 }
 
@@ -145,6 +149,8 @@ AudioDriver::AudioDriver() {
 
 	_last_mix_time = 0;
 	_mix_amount = 0;
+	input_position = 0;
+	input_size = 0;
 
 #ifdef DEBUG_ENABLED
 	prof_time = 0;