diff options
| author | Sven Hesse | 2011-03-29 12:39:51 +0200 |
|---|---|---|
| committer | Sven Hesse | 2011-03-29 12:39:51 +0200 |
| commit | 8291732c946039de5d6e85e6552039fb78616d9c (patch) | |
| tree | 59d0faddb607fbab83c3b32111f0c311113c0965 | |
| parent | f5fb832b634f5101dc88f121d9413ef04b5868bf (diff) | |
| download | scummvm-rg350-8291732c946039de5d6e85e6552039fb78616d9c.tar.gz scummvm-rg350-8291732c946039de5d6e85e6552039fb78616d9c.tar.bz2 scummvm-rg350-8291732c946039de5d6e85e6552039fb78616d9c.zip | |
VIDEO: Fix deLZ77() bound check
The Inca 2 video where Atahualpa walks through the gate after
solving the wisdom challenge now only warns (and graphically
glitches) instead of segfaulting.
| -rw-r--r-- | video/coktel_decoder.cpp | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/video/coktel_decoder.cpp b/video/coktel_decoder.cpp index c8beb3b604..faf32eaffa 100644 --- a/video/coktel_decoder.cpp +++ b/video/coktel_decoder.cpp @@ -1377,11 +1377,12 @@ bool IMDDecoder::renderFrame(Common::Rect &rect) { if ((type == 2) && (rect.width() == _surface.w) && (_x == 0)) { // Directly uncompress onto the video surface - int offsetX = rect.left * _surface.bytesPerPixel; - int offsetY = (_y + rect.top) * _surface.pitch; + const int offsetX = rect.left * _surface.bytesPerPixel; + const int offsetY = (_y + rect.top) * _surface.pitch; + const int offset = offsetX + offsetY; - deLZ77((byte *)_surface.pixels + offsetX + offsetY, dataPtr, dataSize, - _surface.w * _surface.h * _surface.bytesPerPixel); + deLZ77((byte *)_surface.pixels + offset, dataPtr, dataSize, + _surface.w * _surface.h * _surface.bytesPerPixel - offset); return true; } @@ -2244,11 +2245,12 @@ bool VMDDecoder::renderFrame(Common::Rect &rect) { if ((type == 2) && (rect.width() == _surface.w) && (_x == 0) && (_blitMode == 0)) { // Directly uncompress onto the video surface - int offsetX = rect.left * _surface.bytesPerPixel; - int offsetY = (_y + rect.top) * _surface.pitch; + const int offsetX = rect.left * _surface.bytesPerPixel; + const int offsetY = (_y + rect.top) * _surface.pitch; + const int offset = offsetX - offsetY; - deLZ77((byte *)_surface.pixels + offsetX + offsetY, dataPtr, dataSize, - _surface.w * _surface.h * _surface.bytesPerPixel); + deLZ77((byte *)_surface.pixels + offset, dataPtr, dataSize, + _surface.w * _surface.h * _surface.bytesPerPixel - offset); return true; } |