AGI: Fixed invalid memory writes in wordWrapString()

1 files changed, 4 insertions, 2 deletions

diff --git a/engines/agi/text.cpp b/engines/agi/text.cpp
index 6bba90d856..2a159b5d03 100644
--- a/engines/agi/text.cpp
+++ b/engines/agi/text.cpp
@@ -225,8 +225,10 @@ char *AgiEngine::wordWrapString(const char *s, int *len) {
 	const char *pWord;
 	int lnLen, wLen;
 
-	// FIXME: outStr may end up being longer than s, so this can overflow
-	msgBuf = outStr = strdup(s);
+	// Allocate some extra space for the final buffer, as
+	// outStr may end up being longer than s
+	// 26 = 200 (screen height) / 8 (font height) + 1
+	msgBuf = outStr = (char *)malloc(strlen(s) + 26);
 
 	int msgWidth = 0;