diff options
| author | Willem Jan Palenstijn | 2012-11-30 16:10:18 +0100 |
|---|---|---|
| committer | Willem Jan Palenstijn | 2012-11-30 20:06:41 +0100 |
| commit | f2fe1b775a4e344b51ada17415e125998a582efd (patch) | |
| tree | 94067202cd0384fb1de01e3af5eedc22b75438ae | |
| parent | f5dbd23baba645583ffcb9c452f4f88a5f83a412 (diff) | |
| download | scummvm-rg350-f2fe1b775a4e344b51ada17415e125998a582efd.tar.gz scummvm-rg350-f2fe1b775a4e344b51ada17415e125998a582efd.tar.bz2 scummvm-rg350-f2fe1b775a4e344b51ada17415e125998a582efd.zip | |
DREAMWEB: Make frame fixups more specific and add sanity checks
This should detect (and trigger asserts on) the kind of ex frame
data corruption in bug #3591088.
| -rw-r--r-- | engines/dreamweb/object.cpp | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/engines/dreamweb/object.cpp b/engines/dreamweb/object.cpp index 458630753c..ecd38f2abe 100644 --- a/engines/dreamweb/object.cpp +++ b/engines/dreamweb/object.cpp @@ -435,10 +435,23 @@ void DreamWebEngine::deleteExFrame(uint8 frameNum) { _vars._exFramePos -= frameSize; // Adjust all frame pointers pointing into the shifted data - for (unsigned int i = 0; i < 3*kNumexobjects; ++i) { - frame = &_exFrames._frames[i]; - if (frame->ptr() >= startOff) - frame->setPtr(frame->ptr() - frameSize); + for (unsigned int i = 0; i < kNumexobjects; ++i) { + if (_exData[i].mapad[0] != 0xff) { + frame = &_exFrames._frames[3*i+0]; + if (frame->ptr() >= startOff) { + frame->setPtr(frame->ptr() - frameSize); + assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos); + } else { + assert(frame->ptr() + frame->width*frame->height <= startOff); + } + frame = &_exFrames._frames[3*i+1]; + if (frame->ptr() >= startOff) { + frame->setPtr(frame->ptr() - frameSize); + assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos); + } else { + assert(frame->ptr() + frame->width*frame->height <= startOff); + } + } } } |