diff options
| author | toyoshim <toyoshim@chromium.org> | 2015-03-01 22:38:52 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-03-02 06:39:38 +0000 |
| commit | 3cb91369e4dfa935884c0cdbfd1b664b0fe2c026 (patch) | |
| tree | 732e689d1048c7ec94f560aa12ab359b5542f5c5 /media | |
| parent | d3126d1fbaec8f9cbf513ac436ae634e2d12b093 (diff) | |
| download | chromium_src-3cb91369e4dfa935884c0cdbfd1b664b0fe2c026.zip chromium_src-3cb91369e4dfa935884c0cdbfd1b664b0fe2c026.tar.gz chromium_src-3cb91369e4dfa935884c0cdbfd1b664b0fe2c026.tar.bz2 | |
Web MIDI: MIDI input messages may be lost or cause a crash on OS X
MIDIPacketList can contain multiple MIDIPacket, but MIDIPacket objects
have different sizes depending on packet contents. So we should not
refer to MIDIPackets via array index, but should use MIDIPacketNext
that Core MIDI API provides to obtain the next object.
As a result, previous code may refer invalid memory region if large
MIDI messages are received at the same time.
BUG=456780, 374560
Review URL: https://codereview.chromium.org/965793002
Cr-Commit-Position: refs/heads/master@{#318653}
Diffstat (limited to 'media')
| -rw-r--r-- | media/midi/midi_manager_mac.cc | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/media/midi/midi_manager_mac.cc b/media/midi/midi_manager_mac.cc index 912caa1..1378664 100644 --- a/media/midi/midi_manager_mac.cc +++ b/media/midi/midi_manager_mac.cc @@ -286,16 +286,18 @@ void MidiManagerMac::ReadMidi(MIDIEndpointRef source, uint32 port_index = source_map_[source]; // Go through each packet and process separately. + const MIDIPacket* packet = &packet_list->packet[0]; for (size_t i = 0; i < packet_list->numPackets; i++) { // Each packet contains MIDI data for one or more messages (like note-on). - const MIDIPacket &packet = packet_list->packet[i]; - double timestamp_seconds = MIDITimeStampToSeconds(packet.timeStamp); + double timestamp_seconds = MIDITimeStampToSeconds(packet->timeStamp); ReceiveMidiData( port_index, - packet.data, - packet.length, + packet->data, + packet->length, timestamp_seconds); + + packet = MIDIPacketNext(packet); } } |