diff options
author | Colin Snover | 2016-09-11 20:59:39 -0500 |
---|---|---|
committer | Colin Snover | 2016-09-29 19:39:16 -0500 |
commit | 84d8ac4c38bd2aabbbc7ad85ae257db69ba33574 (patch) | |
tree | 65b05551bf9f9df60379b8ee9ad19b3265300a0f | |
parent | 658fb7f8e4c9a43f3f5e21f6b572b2ff2c1cc974 (diff) | |
download | scummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.tar.gz scummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.tar.bz2 scummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.zip |
SCI32: Fix buffer overflow when drawing border to a tiny text bitmap
-rw-r--r-- | engines/sci/graphics/text32.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/engines/sci/graphics/text32.cpp b/engines/sci/graphics/text32.cpp index 11572581ff..254c7d92e6 100644 --- a/engines/sci/graphics/text32.cpp +++ b/engines/sci/graphics/text32.cpp @@ -183,13 +183,15 @@ void GfxText32::drawFrame(const Common::Rect &rect, const int16 size, const uint // NOTE: Not fully disassembled, but this should be right int16 rectWidth = targetRect.width(); - int16 sidesHeight = targetRect.height() - size * 2; + int16 heightRemaining = targetRect.height(); + int16 sidesHeight = heightRemaining - size * 2; int16 centerWidth = rectWidth - size * 2; int16 stride = _width - rectWidth; - for (int16 y = 0; y < size; ++y) { + for (int16 y = 0; y < size && y < heightRemaining; ++y) { memset(pixels, color, rectWidth); pixels += _width; + --heightRemaining; } for (int16 y = 0; y < sidesHeight; ++y) { for (int16 x = 0; x < size; ++x) { @@ -201,9 +203,10 @@ void GfxText32::drawFrame(const Common::Rect &rect, const int16 size, const uint } pixels += stride; } - for (int16 y = 0; y < size; ++y) { + for (int16 y = 0; y < size && y < heightRemaining; ++y) { memset(pixels, color, rectWidth); pixels += _width; + --heightRemaining; } } |