Fix crash in MDL loader caused by bad track bounding.

AliceLR · AliceLR · commit e67185de2dac · 2021-06-13T21:03:53.000-06:00
diff --git a/src/load_mdl.cpp b/src/load_mdl.cpp
@@ -446,7 +446,7 @@ BOOL CSoundFile::ReadMDL(const BYTE *lpStream, DWORD dwMemLength)
 					lpTracks += 2;
 				}
 
-				if ( len > dwMemLength - dwTrackPos ) len = 0;
+				if ( len > dwMemLength - (lpTracks - lpStream) ) len = 0;
 
 				UnpackMDLTrack(m, m_nChannels, PatternSize[ipat], nTrack, lpTracks, len);
 			    }

Original file line number	Diff line number	Diff line change
`@@ -446,7 +446,7 @@ BOOL CSoundFile::ReadMDL(const BYTE *lpStream, DWORD dwMemLength)`
`446`	`446`	`lpTracks += 2;`
`447`	`447`	`}`
`448`	`448`
`449`		`- if ( len > dwMemLength - dwTrackPos ) len = 0;`
	`449`	`+ if ( len > dwMemLength - (lpTracks - lpStream) ) len = 0;`
`450`	`450`
`451`	`451`	`UnpackMDLTrack(m, m_nChannels, PatternSize[ipat], nTrack, lpTracks, len);`
`452`	`452`	`}`