libretro/scummvm
1
0
Fork 0
mirror of https://github.com/libretro/scummvm.git synced 2025-02-21 19:51:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

TOON: Fix more valgrind issues

Browse Source 
Fix potential more invalid read issues in RIF loading
This commit is contained in:
sylvaintv 2011-04-09 19:07:20 +02:00
parent b0351e1b85
commit 0db4498bd9
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
engines/toon/hotspot.cpp
View File

@ -127,7 +127,7 @@ bool Hotspots::LoadRif(Common::String rifName, Common::String additionalRifName)
decoder.unpackM1(rifData, size, _items);
if (rifsize2) {
RncDecoder decoder2;
decoder2.unpackM1(rifData2 , size, _items + (rifsize >> 9));
decoder2.unpackM1(rifData2 , size2, _items + (rifsize >> 9));
for (int32 i = 0; i < (rifsize2 >> 9); i++) {
HotspotData *hot = _items + (rifsize >> 9) + i;
hot->setData(0, hot->getX1() + 1280);

17
engines/toon/tools.cpp
View File

@ -373,8 +373,21 @@ int32 RncDecoder::unpackM1(const void *input, uint16 inputSize, void *output) {
_dstPtr += inputLength;
_srcPtr += inputLength;
_inputByteLeft -= inputLength;
uint16 a = READ_LE_UINT16(_srcPtr);
uint16 b = READ_LE_UINT16(_srcPtr + 2);
uint16 a;
if (_inputByteLeft <= 0)
a = 0;
else if (_inputByteLeft == 1)
a = *_srcPtr;
else
a = READ_LE_UINT16(_srcPtr);
uint16 b;
if (_inputByteLeft <= 2)
b = 0;
else if(_inputByteLeft == 3)
b = *(_srcPtr + 2);
else
b = READ_LE_UINT16(_srcPtr + 2);
_bitBuffl &= ((1 << _bitCount) - 1);
_bitBuffl |= (a << _bitCount);