diff options
| author | Walter van Niftrik | 2010-01-06 20:22:00 +0000 |
|---|---|---|
| committer | Walter van Niftrik | 2010-01-06 20:22:00 +0000 |
| commit | fc582c0e5975b0591268694fd02430504242b4a2 (patch) | |
| tree | 315803932e9d6271a391cfcb535d4090e9532b6c | |
| parent | edc7fcf121bf56052858498d3168c344c00d7442 (diff) | |
| download | scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.tar.gz scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.tar.bz2 scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.zip | |
SCI: Fix overflow in LZS decompressor
svn-id: r47090
| -rw-r--r-- | engines/sci/decompressor.cpp | 10 | ||||
| -rw-r--r-- | engines/sci/decompressor.h | 4 |
2 files changed, 8 insertions, 6 deletions
diff --git a/engines/sci/decompressor.cpp b/engines/sci/decompressor.cpp index c213fca1ed..7d5064fca2 100644 --- a/engines/sci/decompressor.cpp +++ b/engines/sci/decompressor.cpp @@ -901,7 +901,8 @@ int DecompressorLZS::unpack(Common::ReadStream *src, byte *dest, uint32 nPacked, } int DecompressorLZS::unpackLZS() { - uint16 offs = 0, clen; + uint16 offs = 0; + uint32 clen; while (!isFinished()) { if (getBitsMSB(1)) { // Compressed bytes follow @@ -928,8 +929,9 @@ int DecompressorLZS::unpackLZS() { return _dwWrote == _szUnpacked ? 0 : SCI_ERROR_DECOMPRESSION_ERROR; } -uint16 DecompressorLZS::getCompLen() { - int clen, nibble; +uint32 DecompressorLZS::getCompLen() { + uint32 clen; + int nibble; // The most probable cases are hardcoded switch (getBitsMSB(2)) { case 0: @@ -958,7 +960,7 @@ uint16 DecompressorLZS::getCompLen() { } } -void DecompressorLZS::copyComp(int offs, int clen) { +void DecompressorLZS::copyComp(int offs, uint32 clen) { int hpos = _dwWrote - offs; while (clen--) diff --git a/engines/sci/decompressor.h b/engines/sci/decompressor.h index b49452ebc3..ed363621e8 100644 --- a/engines/sci/decompressor.h +++ b/engines/sci/decompressor.h @@ -192,8 +192,8 @@ public: int unpack(Common::ReadStream *src, byte *dest, uint32 nPacked, uint32 nUnpacked); protected: int unpackLZS(); - uint16 getCompLen(); - void copyComp(int offs, int clen); + uint32 getCompLen(); + void copyComp(int offs, uint32 clen); }; #endif |