GOB: Turned _spritesArray into a Common::Array (of fixed size) to detect out-of-bounds access to it (since access is controlled by scripts, this could (and does :/) easily happen. Also removed an obsolete swap() method, and fixed one case where _spritesArray was indeed accessed out of bounds

svn-id: r41305

4 files changed, 4 insertions, 3 deletions

diff --git a/engines/gob/draw.cpp b/engines/gob/draw.cpp
index 3ec9b8b436..8619e08e8b 100644
--- a/engines/gob/draw.cpp
+++ b/engines/gob/draw.cpp
@@ -62,6 +62,8 @@ Draw::Draw(GobEngine *vm) : _vm(vm) {
 	for (int i = 0; i < 8; i++)
 		_fonts[i] = 0;
 
+	_spritesArray.resize(SPRITES_COUNT);
+
 	_invalidatedCount = 0;
 	for (int i = 0; i < 30; i++) {
 		_invalidatedTops[i] = 0;
diff --git a/engines/gob/draw.h b/engines/gob/draw.h
index bfd72429e4..26f78ce3b3 100644
--- a/engines/gob/draw.h
+++ b/engines/gob/draw.h
@@ -78,7 +78,7 @@ public:
 	FontToSprite _fontToSprite[4];
 	Video::FontDesc *_fonts[8];
 
-	SurfaceDescPtr _spritesArray[SPRITES_COUNT];
+	Common::Array<SurfaceDescPtr> _spritesArray;
 
 	int16 _invalidatedCount;
 	int16 _invalidatedTops[30];
diff --git a/engines/gob/inter_v1.cpp b/engines/gob/inter_v1.cpp
index 9199fe074a..7c72d4a1a9 100644
--- a/engines/gob/inter_v1.cpp
+++ b/engines/gob/inter_v1.cpp
@@ -1910,7 +1910,7 @@ bool Inter_v1::o1_fillRect(OpFuncParams &params) {
 
 	_vm->_draw->_backColor = _vm->_parse->parseValExpr();
 
-	if (!_vm->_draw->_spritesArray[(destSurf > 100) ? (destSurf - 80) : destSurf])
+	if (!_vm->_draw->_spritesArray[(destSurf >= 100) ? (destSurf - 80) : destSurf])
 		return false;
 
 	if (_vm->_draw->_spriteRight < 0) {
diff --git a/engines/gob/video.h b/engines/gob/video.h
index 96ade7ffba..c71a18daa6 100644
--- a/engines/gob/video.h
+++ b/engines/gob/video.h
@@ -54,7 +54,6 @@ public:
 	void setVidMem(byte *vidMem);
 	void resize(int16 width, int16 height);
 	void swap(SurfaceDesc &surf);
-	void swap(SurfaceDesc *surf) { assert(surf); swap(*surf); }
 
 	SurfaceDesc(int16 vidMode, int16 width, int16 height, byte *vidMem = 0);
 	~SurfaceDesc() { if (_ownVidMem) delete[] _vidMem; }