The maxSize given when generating a SegmentRef is supposed to be
the maximum size of raw data that can be held inside the offset-
part of a reg_t, not the entire size including the segment.
This fixes a buffer overflow in "Inside the Chest", which still
does not work, but at least doesn't cause heap overflows anymore
with this change.
Thanks to @dafioram for noticing the problem & sending an initial
patch, and to @wjp for noticing further that the PNG reader did not
even use the end info struct it created either.
Fixes Trac#10217. Closes gh-1028.
And fix an out of bounds acces when seeking to the end of a video.
Skipping samples is needed even when seeking through silent edits
because a silent stream is queued for those.
Fixes#10219.
Torin RU map 38140 has an unusual terminator entry; instead of a
normal terminating entry of 11 FFs, its terminating entry is
03 FF FF FF FF C4 36 01 FF FF FF. So, two changes are made:
1. The end-of-map check is now the same as in SSCI1.1+ and only
checks that the final byte of the Audio36 tuple is 0xFF,
instead of the entire tuple;
2. The unneeded entry size heuristic has been turned off for
all SCI32 games.
A quick check of the English versions of LB2CD, EQ1CD, SQ4CD, and
KQ6CD, as well as all English SCI32 games, indicates that this
approach seems to be working correctly.
Fixes Trac#10188.
The original installer copied RESOURCE.SFX to the hard drive so
there was only one RESOURCE.SFX on CD 1. Instead of requiring
users to create duplicates, just use the single RESOURCE.SFX if it
exists.
This fixes a problem in Lighthouse 2.0a where the mini-sub would
fail to start playing the animation of the shipwreck when clicking
on the throttle.
In SSCI, in SCI3 only, r_acc was (inadvertently?) set to the
superclass object ID whenever a super call was made. This happened
because OP_super would call to get the superclass object ID, the
calling conventions of the compiler put this return value into EAX,
and then the PMachine message processing code put whatever was in
EAX into r_acc before each message was processed.
In the game code, there are a sequence of steps that look like
this:
* First, throttle::doVerb is called when throttle is clicked on;
* Which calls getRobot::doit to tell the shipwreck robot to start
playing;
* Which calls wreckBot::init to reset the Robot for the animation;
* Which calls Hiliter::hotVerbs(0) to remove cursor hotspots;
* Which calls Hiliter::dispose to clean up since it is not used;
* Which causes Hiliter::verbList to get set to 0.
* Later, verbList is loaded into r_acc, and it is still 0;
* Then, Hiliter::dispose makes a super call to Obj::dispose;
* Then, Obj::dispose does nothing except call kDisposeClone,
which does not mutate r_acc, so r_acc is still 0 from verbList;
* Then we return back through 5 calls to throttle::doVerb;
* Then throttle::doVerb checks that r_acc is non-zero, and if so,
adds wreckBot to theDoits global, allowing the animation to
occur.
In ScummVM, without setting r_acc in the super call, the non-zero
check failed and the wreckBot didn't get put into theDoits, so the
entire sequence fell apart. In SSCI, the non-zero check happened
to succeed because the Obj::dispose super call put the Obj class
into the accumulator. So now we do that too, and now Lighthouse
2.0a works here.
Earlier versions of SSCI used EAX for other things in between the
OP_super call and the message processing, so would set r_acc from
different data, so this change does not apply to those versions.
