Code: static void ConvertLoopSequence(ModSample &smp, STPLoopList &loopList)
{
	if(!smp.HasSampleData() || loopList.size() < 2) return;

	ModSample newSmp = smp;
	newSmp.nLength = 0;
	newSmp.pSample = nullptr;
 
 	size_t numLoops = loopList.size();
 
 	for(size_t i = 0; i < numLoops; i++)
 	{
 		STPLoopInfo &info = loopList[i];
 
		if((newSmp.nLength + info.loopLength > MAX_SAMPLE_LENGTH) ||
		   (info.loopLength > MAX_SAMPLE_LENGTH) ||
		   (info.loopStart + info.loopLength > smp.nLength))
 		{
 			numLoops = i;
 			break;
		}

		newSmp.nLength += info.loopLength;
	}

	if(!newSmp.AllocateSample())
	{
		return;
	}

	SmpLength start = 0;

	for(size_t i = 0; i < numLoops; i++)
	{
		STPLoopInfo &info = loopList[i];

		memcpy(newSmp.pSample8 + start, smp.pSample8 + info.loopStart, info.loopLength);

		info.loopStart = start;
		if(i > 0 && i <= mpt::size(newSmp.cues))
		{
			newSmp.cues[i - 1] = start;
		}
		start += info.loopLength;
	}

	smp.FreeSample();
	smp = newSmp;

	smp.nLoopStart = 0;
	smp.nLoopEnd = smp.nLength;
	smp.uFlags.set(CHN_LOOP);
}

Commit Message: [Fix] STP: Possible out-of-bounds memory read with malformed STP files (caught with afl-fuzz).

git-svn-id: https://source.openmpt.org/svn/openmpt/trunk/OpenMPT@9567 56274372-70c3-4bfc-bfc3-4c3a0b034d27
CWE ID: CWE-125
static void ConvertLoopSequence(ModSample &smp, STPLoopList &loopList)
{
	if(!smp.HasSampleData() || loopList.size() < 2) return;

	ModSample newSmp = smp;
	newSmp.nLength = 0;
	newSmp.pSample = nullptr;
 
 	size_t numLoops = loopList.size();
 
	// Get the total length of the sample after combining all looped sections
 	for(size_t i = 0; i < numLoops; i++)
 	{
 		STPLoopInfo &info = loopList[i];
 
		// If adding this loop would cause the sample length to exceed maximum,
		if(info.loopStart >= smp.nLength
			|| smp.nLength - info.loopStart < info.loopLength
			|| newSmp.nLength > MAX_SAMPLE_LENGTH - info.loopLength)
 		{
 			numLoops = i;
 			break;
		}

		newSmp.nLength += info.loopLength;
	}

	if(!newSmp.AllocateSample())
	{
		return;
	}

	SmpLength start = 0;

	for(size_t i = 0; i < numLoops; i++)
	{
		STPLoopInfo &info = loopList[i];

		memcpy(newSmp.pSample8 + start, smp.pSample8 + info.loopStart, info.loopLength);

		info.loopStart = start;
		if(i > 0 && i <= mpt::size(newSmp.cues))
		{
			newSmp.cues[i - 1] = start;
		}
		start += info.loopLength;
	}

	smp.FreeSample();
	smp = newSmp;

	smp.nLoopStart = 0;
	smp.nLoopEnd = smp.nLength;
	smp.uFlags.set(CHN_LOOP);
}
