On 26/10/2018 11:34, P J P wrote: > +-- On Fri, 26 Oct 2018, Paolo Bonzini wrote --+ > | I am dumb and I don't understand. In set_ar_dr you get > | > | v = 0xff > | ar = 15 > | dr = 15 > | > | and OPL->AR_TABLE[60] is accessed. The size of the array is 75, which > | seems to be actually 14 more than required. Likewise OPL->DR_TABLE[60] > | is accessed. > | > | The next accesses use SLOT->ksr which is 0 so it's fine too. > > In set_ar_dr > > SLOT->AR = ar ? &OPL->AR_TABLE[ar<<2] : RATE_0; > > SLOT->AR is set to point to OPL->DR_TABLE[60] and while so if s->ksr is set to > 15, in CALC_FCSLOT() > > SLOT->evsa = SLOT->AR[ksr]; <= accesses OPL->AR_TABLE[60 + 15]; Oh, thanks! I said I was dumb. :) So the fix is just this: diff --git a/hw/audio/fmopl.h b/hw/audio/fmopl.h index e7e578a48e..7199afaa3c 100644 --- a/hw/audio/fmopl.h +++ b/hw/audio/fmopl.h @@ -72,8 +72,8 @@ typedef struct fm_opl_f { /* Rhythm sention */ uint8_t rhythm; /* Rhythm mode , key flag */ /* time tables */ - int32_t AR_TABLE[75]; /* atttack rate tables */ - int32_t DR_TABLE[75]; /* decay rate tables */ + int32_t AR_TABLE[76]; /* atttack rate tables */ + int32_t DR_TABLE[76]; /* decay rate tables */ uint32_t FN_TABLE[1024]; /* fnumber -> increment counter */ /* LFO */ int32_t *ams_table; and init_timetables will just fill it with the right value? (I checked against another implementation at http://opl3.cozendey.com/). Thanks, Paolo -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list