libretro/scummvm
1
0
Fork 0
mirror of https://github.com/libretro/scummvm.git synced 2024-12-13 12:39:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

GOB: Turned _spritesArray into a Common::Array (of fixed size) to detect out-of-bounds access to it (since access is controlled by scripts, this could (and does :/) easily happen. Also removed an obsolete swap() method, and fixed one case where _spritesArray was indeed accessed out of bounds

Browse Source 
svn-id: r41305
This commit is contained in:
Max Horn 2009-06-06 21:37:30 +00:00
parent fd94eeead0
commit 3d3da173b0
4 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
engines/gob/draw.cpp
View File

@ -62,6 +62,8 @@ Draw::Draw(GobEngine *vm) : _vm(vm) {
for (int i = 0; i < 8; i++)
_fonts[i] = 0;
_spritesArray.resize(SPRITES_COUNT);
_invalidatedCount = 0;
for (int i = 0; i < 30; i++) {
_invalidatedTops[i] = 0;

2
engines/gob/draw.h
View File

@ -78,7 +78,7 @@ public:
FontToSprite _fontToSprite[4];
Video::FontDesc *_fonts[8];
SurfaceDescPtr _spritesArray[SPRITES_COUNT];
Common::Array<SurfaceDescPtr> _spritesArray;
int16 _invalidatedCount;
int16 _invalidatedTops[30];

2
engines/gob/inter_v1.cpp
View File

@ -1910,7 +1910,7 @@ bool Inter_v1::o1_fillRect(OpFuncParams &params) {
_vm->_draw->_backColor = _vm->_parse->parseValExpr();
if (!_vm->_draw->_spritesArray[(destSurf > 100) ? (destSurf - 80) : destSurf])
if (!_vm->_draw->_spritesArray[(destSurf >= 100) ? (destSurf - 80) : destSurf])
return false;
if (_vm->_draw->_spriteRight < 0) {

1
engines/gob/video.h
View File

@ -54,7 +54,6 @@ public:
void setVidMem(byte *vidMem);
void resize(int16 width, int16 height);
void swap(SurfaceDesc &surf);
void swap(SurfaceDesc *surf) { assert(surf); swap(*surf); }
SurfaceDesc(int16 vidMode, int16 width, int16 height, byte *vidMem = 0);
~SurfaceDesc() { if (_ownVidMem) delete[] _vidMem; }