Don't read past the end of the impulseResponse array

Source/core/platform/audio/ReverbConvolverStage.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 41 matching lines @@
 {
     ASSERT(impulseResponse);
     ASSERT(accumulationBuffer);
 
     if (!m_directMode) {
         m_fftKernel = adoptPtr(new FFTFrame(fftSize));
         m_fftKernel->doPaddedFFT(impulseResponse + stageOffset, stageLength);
         m_fftConvolver = adoptPtr(new FFTConvolver(fftSize));
     } else {
         m_directKernel = adoptPtr(new AudioFloatArray(fftSize / 2));
-        m_directKernel->copyToRange(impulseResponse + stageOffset, 0, fftSize / 2);
+        m_directKernel->copyToRange(impulseResponse + stageOffset, 0, std::min(stageLength, fftSize / 2));

[Ken Russell (switch to Gerrit), 2013/08/29 21:49:23]

Why does this guarantee that we won't read beyond the end of the impulseResponse
array?

The header says that the second argument to this constructor is called
"responseLength". However, this argument is *ignored* here in the
implementation. Why is the correct value then not (something like):

  std::min(std::max(0, responseLength - stageOffset), fftSize / 2)

Though taking into account that responseLength and stageOffset are both
unsigned?

         m_directConvolver = adoptPtr(new DirectConvolver(renderSliceSize));
     }
     m_temporaryBuffer.allocate(renderSliceSize);
 
     // The convolution stage at offset stageOffset needs to have a corresponding delay to cancel out the offset.
     size_t totalDelay = stageOffset + reverbTotalLatency;
 
     // But, the FFT convolution itself incurs fftSize / 2 latency, so subtract this out...
     size_t halfSize = fftSize / 2;
     if (!m_directMode) {
@@ skipping 100 matching lines @@
         m_directConvolver->reset();
     m_preDelayBuffer.zero();
     m_accumulationReadIndex = 0;
     m_inputReadIndex = 0;
     m_framesProcessed = 0;
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)