when 'remaining' is larger than number of samples in buffer, reading
continues behind buffer boundary, resulting is SIGSEG

---
 lib/rtl/rtl_source_c.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/rtl/rtl_source_c.cc b/lib/rtl/rtl_source_c.cc
index 3c29e42..accaaa9 100644
--- a/lib/rtl/rtl_source_c.cc
+++ b/lib/rtl/rtl_source_c.cc
@@ -370,7 +370,7 @@ int rtl_source_c::work( int noutput_items,
 
     int remaining = noutput_items - _samp_avail;
 
-    for (int i = 0; i < remaining; ++i)
+    for (int i = 0; i < remaining && i < int(_buf_len /
BYTES_PER_SAMPLE); ++i)
       *out++ = _lut[ *(buf + i) ];
 
     _buf_offset = remaining;
-- 
2.0.2



Reply via email to