WASAPI hardening / fixing

CHANGELOG.md

@@ -62,6 +62,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **WASAPI**: Output streams now start with real audio immediately instead of undefined content in the render buffer.
 - **WASAPI**: A stream paused immediately after starting no longer plays silence before real audio on resume.
 - **WASAPI**: Fix `I64` and `F64` incorrectly reported as supported output formats.
+- **WASAPI**: Formats with a `cbSize` that doesn't cover the extension, and configurations whose
+  derived `WAVEFORMATEX` fields would overflow, are now rejected instead of being read out of
+  bounds, panicking, or wrapping.
+- **WASAPI**: A buffer size or padding count beyond the stream's negotiated bounds, or a capture
+  packet larger than its buffer, is now rejected with a backend error instead of panicking,
+  over-reading, or allocating gigabytes.
+- **WASAPI**: Empty capture packets are no longer delivered as a null buffer, packets the engine
+  marks silent now arrive as silence, and a slow data callback no longer leaves `stop()` and
+  `Drop` unserviced.
 
 ## [0.18.2] - 2026-08-16
 

src/host/aaudio/mod.rs

@@ -1,6 +1,8 @@
 //! AAudio backend implementation.
 //!
 //! Default backend on Android.
+//!
+//! The stream-build `timeout` is ignored.
 
 use std::{
     fmt,

src/host/alsa/mod.rs

@@ -1,6 +1,9 @@
 //! ALSA backend implementation.
 //!
 //! Default backend on Linux and BSD systems.
+//!
+//! The stream-build `timeout` is not a setup bound: it becomes the `poll()` timeout of the
+//! stream's run loop, so it applies for the life of the stream, and `None` polls forever.
 
 extern crate alsa;
 #[cfg(feature = "realtime")]

src/host/asio/mod.rs

@@ -2,6 +2,8 @@
 //!
 //! ASIO is available on Windows with the `asio` feature.
 //! See the project README for setup instructions.
+//!
+//! The stream-build `timeout` is ignored.
 
 extern crate asio_sys as sys;
 

src/host/audioworklet/mod.rs

@@ -2,6 +2,8 @@
 //!
 //! Available on WebAssembly with the `audioworklet` feature. Requires atomics support.
 //! See the `audioworklet` example for setup instructions.
+//!
+//! The stream-build `timeout` is ignored.
 
 use std::{
     cell::RefCell,

src/host/coreaudio/mod.rs

@@ -1,6 +1,9 @@
 //! CoreAudio backend implementation.
 //!
 //! Default backend on macOS, iOS, and tvOS.
+//!
+//! On macOS the stream-build `timeout` bounds the device rate change made during setup, with a
+//! one-second default; on iOS it is ignored.
 
 use objc2_core_audio_types::{
     AudioStreamBasicDescription, kAudioFormatFlagIsFloat, kAudioFormatFlagIsPacked,

src/host/equilibrium.rs

@@ -54,3 +54,52 @@ pub fn fill_equilibrium(buffer: &mut [u8], sample_format: SampleFormat) {
         }
     }
 }
+
+#[test]
+fn test_fill_equilibrium_byte_patterns() {
+    let mut buf = vec![0u8; 8].into_boxed_slice();
+
+    // Unsigned 8-bit silence is 0x80, the midpoint of the range.
+    fill_equilibrium(&mut buf[..], SampleFormat::U8);
+    assert_eq!(buf[0], 0x80);
+    assert_eq!(buf[5], 0x80);
+
+    // Signed and float formats rest at zero.
+    fill_equilibrium(&mut buf[..], SampleFormat::I16);
+    assert_eq!(buf[0], 0);
+    assert_eq!(buf[5], 0);
+    fill_equilibrium(&mut buf[..], SampleFormat::I24);
+    assert_eq!(buf[0], 0);
+    assert_eq!(buf[5], 0);
+    fill_equilibrium(&mut buf[..], SampleFormat::F32);
+    assert_eq!(buf[0], 0);
+    assert_eq!(buf[5], 0);
+
+    // DSD silence is the 0x69 pattern.
+    fill_equilibrium(&mut buf[..], SampleFormat::DsdU8);
+    assert_eq!(buf[0], 0x69);
+    assert_eq!(buf[5], 0x69);
+
+    // Multi-byte unsigned formats take the typed path, the only one that casts the buffer to a
+    // wider pointer: check the value written and that `chunks_exact` accounts for every byte.
+    fill_equilibrium(&mut buf[..], SampleFormat::U16);
+    assert!(
+        buf.chunks_exact(2)
+            .all(|c| u16::from_ne_bytes(c.try_into().unwrap()) == 0x8000)
+    );
+    fill_equilibrium(&mut buf[..], SampleFormat::U24);
+    assert!(
+        buf.chunks_exact(4)
+            .all(|c| i32::from_ne_bytes(c.try_into().unwrap()) == 0x0080_0000)
+    );
+    fill_equilibrium(&mut buf[..], SampleFormat::U32);
+    assert!(
+        buf.chunks_exact(4)
+            .all(|c| u32::from_ne_bytes(c.try_into().unwrap()) == 0x8000_0000)
+    );
+    fill_equilibrium(&mut buf[..], SampleFormat::U64);
+    assert!(
+        buf.chunks_exact(8)
+            .all(|c| u64::from_ne_bytes(c.try_into().unwrap()) == 0x8000_0000_0000_0000)
+    );
+}

src/host/jack/mod.rs

@@ -1,6 +1,7 @@
 //! JACK backend implementation.
 //!
 //! Available on all platforms with the `jack` feature. Requires JACK server and client libraries.
+//! The stream-build `timeout` bounds the whole build, including opening the JACK client.
 
 extern crate jack;
 

src/host/mod.rs

@@ -243,8 +243,8 @@ pub(crate) use error_emit::try_emit_error;
     target_os = "dragonfly",
     target_os = "freebsd",
     target_os = "netbsd",
-    target_os = "windows",
     target_vendor = "apple",
+    all(windows, any(feature = "asio", feature = "jack")),
     all(
         target_arch = "wasm32",
         target_os = "unknown",

src/host/pipewire/mod.rs

@@ -1,3 +1,9 @@
+//! PipeWire backend implementation.
+//!
+//! Default backend on Linux when PipeWire is available.
+//!
+//! The stream-build `timeout` bounds stream initialization, waiting two seconds when given `None`.
+
 use std::sync::{
     Arc,
     atomic::{AtomicBool, Ordering},

src/host/pulseaudio/mod.rs

@@ -1,3 +1,9 @@
+//! PulseAudio backend implementation.
+//!
+//! Default backend on Linux and BSD systems when PipeWire is unavailable.
+//!
+//! The stream-build `timeout` bounds stream creation.
+
 use std::{
     ffi::CString,
     fmt,