diff options
author | Torbjörn Andersson | 2013-02-18 20:12:35 +0100 |
---|---|---|
committer | Torbjörn Andersson | 2013-02-18 20:12:35 +0100 |
commit | 21ed47ce1366ee6b9b861391faeccc0eb2c5afb3 (patch) | |
tree | ebba52cedafb8477a74003351c8a641229919a19 | |
parent | f70905d979953fc52954ba5f7d8b4ae149179a56 (diff) | |
download | scummvm-rg350-21ed47ce1366ee6b9b861391faeccc0eb2c5afb3.tar.gz scummvm-rg350-21ed47ce1366ee6b9b861391faeccc0eb2c5afb3.tar.bz2 scummvm-rg350-21ed47ce1366ee6b9b861391faeccc0eb2c5afb3.zip |
VIDEO: Fix Smacker crash, as per madmoose's suggestion
Apparently, in some movies the Smacker decoder would peek ahead
past the end of the bitstream, even though it didn't necessarily
use all of those bits later. Fix that by first checking how many
bits are still available. (This was originally reported for the
mg1shoot.smk cutscene in the 4 CD version of The Feeble Files.)
-rw-r--r-- | NEWS | 1 | ||||
-rw-r--r-- | video/smk_decoder.cpp | 4 |
2 files changed, 3 insertions, 2 deletions
@@ -22,6 +22,7 @@ For a more comprehensive changelog of the latest experimental code, see: change it at all. - Updated MT-32 emulation code to latest munt project snapshot. - Added FluidSynth settings dialog, mainly for reverb and chorus settings. + - Fixed crash on certain Smacker movies. Cine: - Improved audio support for Amiga and AtariST versions of Future Wars. diff --git a/video/smk_decoder.cpp b/video/smk_decoder.cpp index c49791100d..4e18268e72 100644 --- a/video/smk_decoder.cpp +++ b/video/smk_decoder.cpp @@ -119,7 +119,7 @@ uint16 SmallHuffmanTree::decodeTree(uint32 prefix, int length) { } uint16 SmallHuffmanTree::getCode(Common::BitStream &bs) { - byte peek = bs.peekBits(8); + byte peek = bs.peekBits(MIN<uint32>(bs.size() - bs.pos(), 8)); uint16 *p = &_tree[_prefixtree[peek]]; bs.skip(_prefixlength[peek]); @@ -257,7 +257,7 @@ uint32 BigHuffmanTree::decodeTree(uint32 prefix, int length) { } uint32 BigHuffmanTree::getCode(Common::BitStream &bs) { - byte peek = bs.peekBits(8); + byte peek = bs.peekBits(MIN<uint32>(bs.size() - bs.pos(), 8)); uint32 *p = &_tree[_prefixtree[peek]]; bs.skip(_prefixlength[peek]); |