Validate length of sysex for YM2612 direct write

Author: rhargreaves

src/midi.c

@@ -538,6 +538,15 @@ static void incrementSysExCursor(const u8** data, u16* length, u8 value)
     (*length) -= value;
 }
 
+static void directWriteYm2612(u8 part, const u8* data, u16 length)
+{
+    if (length != 4) {
+        return;
+    }
+    synth_directWriteYm2612(
+        part, data[0] << 4 | data[1], data[2] << 4 | data[3]);
+}
+
 static void handleCustomSysEx(const u8* data, u16 length)
 {
     u8 command = *data;
@@ -577,12 +586,10 @@ static void handleCustomSysEx(const u8* data, u16 length)
         loadPsgEnvelope(data, length);
         break;
     case SYSEX_COMMAND_WRITE_YM2612_REG_PART_0:
-        synth_directWriteYm2612(
-            0, data[0] << 4 | data[1], data[2] << 4 | data[3]);
+        directWriteYm2612(0, data, length);
         break;
     case SYSEX_COMMAND_WRITE_YM2612_REG_PART_1:
-        synth_directWriteYm2612(
-            1, data[0] << 4 | data[1], data[2] << 4 | data[3]);
+        directWriteYm2612(1, data, length);
         break;
     }
 }

tests/unit/main.c

@@ -169,6 +169,8 @@ int main(void)
         midi_test(test_midi_sysex_sets_original_total_level_values),
         midi_test(test_midi_sysex_writes_directly_to_ym2612_regs_part_0),
         midi_test(test_midi_sysex_writes_directly_to_ym2612_regs_part_1),
+        midi_test(
+            test_midi_sysex_ignores_incorrect_length_ym2612_direct_writes),
         midi_test(
             test_midi_sets_all_channel_mappings_when_setting_polyphonic_mode),
         midi_test(test_midi_shows_fm_parameter_ui),

tests/unit/test_midi_sysex.c

@@ -279,4 +279,22 @@ static void test_midi_sysex_writes_directly_to_ym2612_regs_part_1(
     expect_value(__wrap_synth_directWriteYm2612, reg, 0xB1);
     expect_value(__wrap_synth_directWriteYm2612, data, 0x12);
     __real_midi_sysex(sequence, sizeof(sequence));
+}
+
+static void test_midi_sysex_ignores_incorrect_length_ym2612_direct_writes(
+    UNUSED void** state)
+{
+    const u8 badSeq1[] = { SYSEX_MANU_EXTENDED, SYSEX_MANU_REGION,
+        SYSEX_MANU_ID, SYSEX_COMMAND_WRITE_YM2612_REG_PART_0, 0x0B, 0x01, 0x01,
+        0x02, 0x02 };
+    __real_midi_sysex(badSeq1, sizeof(badSeq1));
+
+    const u8 badSeq2[]
+        = { SYSEX_MANU_EXTENDED, SYSEX_MANU_REGION, SYSEX_MANU_ID,
+              SYSEX_COMMAND_WRITE_YM2612_REG_PART_0, 0x0B, 0x01, 0x01 };
+    __real_midi_sysex(badSeq2, sizeof(badSeq2));
+
+    const u8 badSeq3[] = { SYSEX_MANU_EXTENDED, SYSEX_MANU_REGION,
+        SYSEX_MANU_ID, SYSEX_COMMAND_WRITE_YM2612_REG_PART_0 };
+    __real_midi_sysex(badSeq3, sizeof(badSeq3));
 }