diff options
author | Thierry Crozat | 2011-06-14 23:15:30 +0100 |
---|---|---|
committer | Thierry Crozat | 2011-06-14 23:15:50 +0100 |
commit | 38c99889382c7142b3cb94a5a5bae5266f4ab7a3 (patch) | |
tree | bce59676bf562b8974a526981f3e3b9e53d90c9e | |
parent | 1ca44c076c261dedc605401d39b51603fc0282af (diff) | |
download | scummvm-rg350-38c99889382c7142b3cb94a5a5bae5266f4ab7a3.tar.gz scummvm-rg350-38c99889382c7142b3cb94a5a5bae5266f4ab7a3.tar.bz2 scummvm-rg350-38c99889382c7142b3cb94a5a5bae5266f4ab7a3.zip |
COMMON: Fix crash in TranslationManager when reading long strings
It was writing data beyond the end of a buffer. This change makes
sure this does not happen. It only changes reading of the messages
since the language codes, charset names and contexts are always
much smaller than the buffer.
-rw-r--r-- | common/translation.cpp | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/common/translation.cpp b/common/translation.cpp index dc71ddc52f..526bebcec6 100644 --- a/common/translation.cpp +++ b/common/translation.cpp @@ -302,8 +302,13 @@ void TranslationManager::loadTranslationsInfoDat() { _messageIds.resize(numMessages); for (int i = 0; i < numMessages; ++i) { len = in.readUint16BE(); - in.read(buf, len); - _messageIds[i] = String(buf, len - 1); + String msg; + while (len > 0) { + in.read(buf, len > 256 ? 256 : len); + msg += String(buf, len > 256 ? 256 : len - 1); + len -= 256; + } + _messageIds[i] = msg; } } @@ -357,8 +362,13 @@ void TranslationManager::loadLanguageDat(int index) { for (int i = 0; i < nbMessages; ++i) { _currentTranslationMessages[i].msgid = in.readUint16BE(); len = in.readUint16BE(); - in.read(buf, len); - _currentTranslationMessages[i].msgstr = String(buf, len - 1); + String msg; + while (len > 0) { + in.read(buf, len > 256 ? 256 : len); + msg += String(buf, len > 256 ? 256 : len - 1); + len -= 256; + } + _currentTranslationMessages[i].msgstr = msg; len = in.readUint16BE(); if (len > 0) { in.read(buf, len); |