Merge pull request #9297 from Kelebek1/sink_oob

[audio_core] Fix an OoB with sample sinking

1 files changed, 8 insertions, 6 deletions

diff --git a/src/audio_core/renderer/command/command_buffer.cpp b/src/audio_core/renderer/command/command_buffer.cpp
index 2ef879ee1..8c6fe97e7 100644
--- a/src/audio_core/renderer/command/command_buffer.cpp
+++ b/src/audio_core/renderer/command/command_buffer.cpp
@@ -460,21 +460,23 @@ void CommandBuffer::GenerateDeviceSinkCommand(const s32 node_id, const s16 buffe
 
     cmd.session_id = session_id;
 
+    cmd.input_count = parameter.input_count;
+    s16 max_input{0};
+    for (u32 i = 0; i < parameter.input_count; i++) {
+        cmd.inputs[i] = buffer_offset + parameter.inputs[i];
+        max_input = std::max(max_input, cmd.inputs[i]);
+    }
+
     if (state.upsampler_info != nullptr) {
         const auto size_{state.upsampler_info->sample_count * parameter.input_count};
         const auto size_bytes{size_ * sizeof(s32)};
         const auto addr{memory_pool->Translate(state.upsampler_info->samples_pos, size_bytes)};
         cmd.sample_buffer = {reinterpret_cast<s32*>(addr),
-                             parameter.input_count * state.upsampler_info->sample_count};
+                             (max_input + 1) * state.upsampler_info->sample_count};
     } else {
         cmd.sample_buffer = samples_buffer;
     }
 
-    cmd.input_count = parameter.input_count;
-    for (u32 i = 0; i < parameter.input_count; i++) {
-        cmd.inputs[i] = buffer_offset + parameter.inputs[i];
-    }
-
     GenerateEnd<DeviceSinkCommand>(cmd);
 }