diff options
| author | Paul Gilbert | 2017-10-10 19:50:35 -0400 |
|---|---|---|
| committer | Paul Gilbert | 2017-10-10 19:50:35 -0400 |
| commit | 0fd4e80cb29d7b2f58b303b5ba5f380d5c51c0e4 (patch) | |
| tree | 3fe5a4df68ac946bca8260724964f9169ae20e69 | |
| parent | 567556a5c111953e09490f3f3257b6449c398117 (diff) | |
| download | scummvm-rg350-0fd4e80cb29d7b2f58b303b5ba5f380d5c51c0e4.tar.gz scummvm-rg350-0fd4e80cb29d7b2f58b303b5ba5f380d5c51c0e4.tar.bz2 scummvm-rg350-0fd4e80cb29d7b2f58b303b5ba5f380d5c51c0e4.zip | |
TITANIC: Fix buffer overflow in parser searchAndReplace
| -rw-r--r-- | engines/titanic/true_talk/tt_parser.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/engines/titanic/true_talk/tt_parser.cpp b/engines/titanic/true_talk/tt_parser.cpp index f230179f96..2331cbebde 100644 --- a/engines/titanic/true_talk/tt_parser.cpp +++ b/engines/titanic/true_talk/tt_parser.cpp @@ -371,6 +371,7 @@ int TTparser::searchAndReplace(TTstring &line, int startIndex, const StringArray // Replace the text in the line with it's replacement line = CString(line.c_str(), line.c_str() + startIndex) + replacementStr + CString(line.c_str() + startIndex + origStr.size()); + lineSize = line.size(); startIndex += replacementStr.size(); break; |