AVALANCHE: Fix crash when entering inn, add safeguards

2 files changed, 11 insertions, 5 deletions

diff --git a/engines/avalanche/background.cpp b/engines/avalanche/background.cpp
index 54ab459d41..fc172871cc 100644
--- a/engines/avalanche/background.cpp
+++ b/engines/avalanche/background.cpp
@@ -109,7 +109,7 @@ void Background::update() {
 			break;
 		default:
 			if (_vm->_roomTime % 200 <= 178) { // Normally.
-				byte direction = 0;
+				byte direction = 1;
 				uint16 angle = _vm->bearing(1);
 				if (((angle >= 1) && (angle <= 90)) || ((angle >= 358) && (angle <= 360)))
 					direction = 3;
@@ -315,6 +315,8 @@ void Background::release() {
  * @remarks	Originally called 'show_one'
  */
 void Background::draw(int16 destX, int16 destY, byte sprId) {
+	assert(sprId < 40);
+
 	if (_sprites[sprId]._x > kOnDisk) {
 		if (destX < 0) {
 			destX = _sprites[sprId]._x * 8;
diff --git a/engines/avalanche/graphics.cpp b/engines/avalanche/graphics.cpp
index 0b16590785..b3ba95fd80 100644
--- a/engines/avalanche/graphics.cpp
+++ b/engines/avalanche/graphics.cpp
@@ -540,8 +540,10 @@ void GraphicManager::drawSprite(AnimationType *sprite, byte picnum, int16 x, int
 	// First we make the pixels of the sprite blank.
 	for (int j = 0; j < sprite->_yLength; j++) {
 		for (int i = 0; i < sprite->_xLength; i++) {
-			if (((*sprite->_sil[picnum])[j][i / 8] >> ((7 - i % 8)) & 1) == 0)
-				*(byte *)_surface.getBasePtr(x + i, y + j) = 0;
+			if ((x + i < _surface.w) && (y + j < _surface.h)) {
+				if (((*sprite->_sil[picnum])[j][i / 8] >> ((7 - i % 8)) & 1) == 0)
+					*(byte *)_surface.getBasePtr(x + i, y + j) = 0;
+			}
 		}
 	}
 
@@ -553,8 +555,10 @@ void GraphicManager::drawSprite(AnimationType *sprite, byte picnum, int16 x, int
 			for (uint16 i = 0; i < sprite->_xLength; i += 8) {
 				byte pixel = (*sprite->_mani[picnum])[maniPos++];
 				for (int bit = 0; bit < 8; bit++) {
-					byte pixelBit = (pixel >> bit) & 1;
-					*(byte *)_surface.getBasePtr(x + i + 7 - bit, y + j) += (pixelBit << plane);
+					if ((x + i + 7 < _surface.w) && (y + j < _surface.h)) {
+						byte pixelBit = (pixel >> bit) & 1;
+						*(byte *)_surface.getBasePtr(x + i + 7 - bit, y + j) += (pixelBit << plane);
+					}
 				}
 			}
 		}