diff options
| author | Willem Jan Palenstijn | 2016-10-25 23:11:13 +0200 |
|---|---|---|
| committer | Willem Jan Palenstijn | 2016-10-25 23:13:22 +0200 |
| commit | b4515d087257e1ab27712dc1bffece3f1cd39391 (patch) | |
| tree | 8d94107680250d9e77fd861266c610f9ef8514d6 | |
| parent | 97bc65e82f0f9efeb07d84a876ee2fd7f9b24780 (diff) | |
| download | scummvm-rg350-b4515d087257e1ab27712dc1bffece3f1cd39391.tar.gz scummvm-rg350-b4515d087257e1ab27712dc1bffece3f1cd39391.tar.bz2 scummvm-rg350-b4515d087257e1ab27712dc1bffece3f1cd39391.zip | |
KYRA: (LOL) Fix buffer overflow in _lastOverridePalFile
It was storing filenames of length 12 in a char[12] buffer.
Fixes bug #9627.
| -rw-r--r-- | engines/kyra/lol.h | 3 | ||||
| -rw-r--r-- | engines/kyra/scene_lol.cpp | 14 |
2 files changed, 7 insertions, 10 deletions
diff --git a/engines/kyra/lol.h b/engines/kyra/lol.h index af58397200..9f952e5df6 100644 --- a/engines/kyra/lol.h +++ b/engines/kyra/lol.h @@ -987,8 +987,7 @@ private: uint16 _specialGuiShapeY; uint16 _specialGuiShapeMirrorFlag; - char _lastOverridePalFile[12]; - char *_lastOverridePalFilePtr; + Common::String _lastOverridePalFile; int _lastSpecialColor; int _lastSpecialColorWeight; diff --git a/engines/kyra/scene_lol.cpp b/engines/kyra/scene_lol.cpp index 391de5e49c..a746080190 100644 --- a/engines/kyra/scene_lol.cpp +++ b/engines/kyra/scene_lol.cpp @@ -303,12 +303,10 @@ void LoLEngine::loadLevelGraphics(const char *file, int specialColor, int weight _lastSpecialColor = specialColor; _lastSpecialColorWeight = weight; strcpy(_lastBlockDataFile, file); - if (palFile) { - strcpy(_lastOverridePalFile, palFile); - _lastOverridePalFilePtr = _lastOverridePalFile; - } else { - _lastOverridePalFilePtr = 0; - } + if (palFile) + _lastOverridePalFile = palFile; + else + _lastOverridePalFile.clear(); } if (_flags.use16ColorMode) { @@ -361,8 +359,8 @@ void LoLEngine::loadLevelGraphics(const char *file, int specialColor, int weight memcpy(_vcnColTable, v, 128); v += 128; - if (_lastOverridePalFilePtr) { - _res->loadFileToBuf(_lastOverridePalFilePtr, _screen->getPalette(0).getData(), 384); + if (!_lastOverridePalFile.empty()) { + _res->loadFileToBuf(_lastOverridePalFile.c_str(), _screen->getPalette(0).getData(), 384); } else { _screen->getPalette(0).copy(v, 0, 128); } |