From 61aa230417f940c7c8a78671ca9a6f959d793d6d Mon Sep 17 00:00:00 2001
From: sezero <[EMAIL REDACTED]>
Date: Thu, 31 Jul 2025 05:56:10 +0300
Subject: [PATCH] init_soundfont: fix segfault (off-by-one upper limit in the
for loop.)
otwerwise, out-of-bounds read happens in parse_preset() for to_ndx.
---
src/timidity/sndfont.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/timidity/sndfont.c b/src/timidity/sndfont.c
index 3a6cf03b..adcc89bb 100644
--- a/src/timidity/sndfont.c
+++ b/src/timidity/sndfont.c
@@ -146,7 +146,7 @@ void init_soundfont(MidiSong *song, const char *fname, int order)
sfrec.fname = SDL_strdup(fname);
load_sbk(sfrec.io, &sfinfo);
- for (i = 0; i < sfinfo.nrpresets; i++) {
+ for (i = 0; i < sfinfo.nrpresets - 1; i++) {
int bank = sfinfo.presethdr[i].bank;
int preset = sfinfo.presethdr[i].preset;
if (is_excluded(bank, preset, -1))