From fbb9ebabb28057ed51e168404828598cc997852a Mon Sep 17 00:00:00 2001
From: Paul Fd <paul@ferrand.cc>
Date: Mon, 6 Apr 2020 01:22:14 +0200
Subject: [PATCH] Check that the index passed to the curves arenot too crazy

---
 src/sfizz/Config.h  |  1 +
 src/sfizz/Curve.cpp |  6 ++++++
 tests/CurveT.cpp    | 11 +++++++++++
 3 files changed, 18 insertions(+)

diff --git a/src/sfizz/Config.h b/src/sfizz/Config.h
index 727a125f..48aeb70f 100644
--- a/src/sfizz/Config.h
+++ b/src/sfizz/Config.h
@@ -56,6 +56,7 @@ namespace config {
     constexpr size_t powerHistoryLength { 16 };
     constexpr float voiceStealingThreshold { 0.00001f };
     constexpr uint16_t numCCs { 512 };
+    constexpr int maxCurves { 256 };
     constexpr int chunkSize { 1024 };
     constexpr int filtersInPool { maxVoices * 2 };
     constexpr int filtersPerVoice { 2 };
diff --git a/src/sfizz/Curve.cpp b/src/sfizz/Curve.cpp
index 44aa3c24..f349efad 100644
--- a/src/sfizz/Curve.cpp
+++ b/src/sfizz/Curve.cpp
@@ -196,6 +196,12 @@ void CurveSet::addCurve(const Curve& curve, int explicitIndex)
 {
     std::unique_ptr<Curve>* slot;
 
+    if (explicitIndex < -1)
+        return;
+
+    if (explicitIndex >= config::maxCurves)
+        return;
+
     if (explicitIndex == -1) {
         if (_useExplicitIndexing)
             return; // reject implicit indices if any were explicit before
diff --git a/tests/CurveT.cpp b/tests/CurveT.cpp
index 9c8b054b..1aa9e161 100644
--- a/tests/CurveT.cpp
+++ b/tests/CurveT.cpp
@@ -199,6 +199,17 @@ TEST_CASE("[Curve] Add curves to CurveSet")
     REQUIRE( curveSet.getCurve(4).evalCC7(0) == 1.0f );
 }
 
+TEST_CASE("[Curve] Add bad indices")
+{
+    sfz::CurveSet curveSet;
+    curveSet.addCurve(sfz::Curve::buildPredefinedCurve(0), -2);
+    REQUIRE( curveSet.getNumCurves() == 0 );
+    curveSet.addCurve(sfz::Curve::buildPredefinedCurve(0), 256);
+    REQUIRE( curveSet.getNumCurves() == 0 );
+    curveSet.addCurve(sfz::Curve::buildPredefinedCurve(0), 512);
+    REQUIRE( curveSet.getNumCurves() == 0 );
+}
+
 TEST_CASE("[Curve] Default CurveSet")
 {
     auto curveSet = sfz::CurveSet::createPredefined();