aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTorbjörn Andersson2006-09-17 15:25:59 +0000
committerTorbjörn Andersson2006-09-17 15:25:59 +0000
commit3e8380f2c6889c85e0e962631eaf9814c2f84963 (patch)
treeebee33a6db799254f0583a83daa3595a65bdb51f
parent45035813402d95e9b151463ba11d92d8bb136ab7 (diff)
downloadscummvm-rg350-3e8380f2c6889c85e0e962631eaf9814c2f84963.tar.gz
scummvm-rg350-3e8380f2c6889c85e0e962631eaf9814c2f84963.tar.bz2
scummvm-rg350-3e8380f2c6889c85e0e962631eaf9814c2f84963.zip
Only decompress the number of speech samples indicated by 'resSize'. This
prevents crashes in the demo, and is probably a good idea anyway. svn-id: r23917
-rw-r--r--NEWS3
-rw-r--r--engines/sword1/sound.cpp16
2 files changed, 14 insertions, 5 deletions
diff --git a/NEWS b/NEWS
index 83c743db35..6207a59030 100644
--- a/NEWS
+++ b/NEWS
@@ -38,6 +38,9 @@ For a more comprehensive changelog for the latest experimental SVN code, see:
BASS:
- Fixed character spacing in LINC terminals in floppy version v0.0303
+ Broken Sword 1:
+ - Fixed speech-related crashes.
+
Broken Sword 2:
- More robust handling of the optional startup.inf file.
diff --git a/engines/sword1/sound.cpp b/engines/sword1/sound.cpp
index c2576ee7d4..f699a4c475 100644
--- a/engines/sword1/sound.cpp
+++ b/engines/sword1/sound.cpp
@@ -260,24 +260,30 @@ int16 *Sound::uncompressSpeech(uint32 index, uint32 cSize, uint32 *size) {
uint32 srcPos = headerPos >> 1;
cSize /= 2;
uint32 dstPos = 0;
- /* alloc 200 additional bytes, as the demo sometimes has ASCII junk
- at the end of the wave data */
- int16 *dstData = (int16*)malloc(resSize * 2 + 200);
- while (srcPos < cSize) {
+ int16 *dstData = (int16*)malloc(resSize * 2);
+ int32 samplesLeft = resSize;
+ while (srcPos < cSize && samplesLeft > 0) {
int16 length = (int16)READ_LE_UINT16(srcData + srcPos);
srcPos++;
if (length < 0) {
length = -length;
+ if (length > samplesLeft)
+ length = samplesLeft;
for (uint16 cnt = 0; cnt < (uint16)length; cnt++)
dstData[dstPos++] = srcData[srcPos];
srcPos++;
} else {
+ if (length > samplesLeft)
+ length = samplesLeft;
memcpy(dstData + dstPos, srcData + srcPos, length * 2);
dstPos += length;
srcPos += length;
}
+ samplesLeft -= length;
+ }
+ if (samplesLeft > 0) {
+ memset(dstData + dstPos, 0, samplesLeft * 2);
}
- assert(dstPos < (uint32)resSize + 100);
if (_cowMode == CowDemo) // demo has wave output size embedded in the compressed data
*(uint32*)dstData = 0;
free(fBuf);