diff options
| author | Sven Hesse | 2014-05-26 18:13:38 +0200 |
|---|---|---|
| committer | Eugene Sandulenko | 2016-09-29 22:33:34 +0200 |
| commit | 10708f7a8d267ffaa89d739d42686fe12d26e92c (patch) | |
| tree | 8e402776edccbe9ced250b2349b32e0d42cb179d /engines/bladerunner/decompress_lcw.cpp | |
| parent | 7b6159e0957a61135e9636b1c7a28f3e343cbb7e (diff) | |
| download | scummvm-rg350-10708f7a8d267ffaa89d739d42686fe12d26e92c.tar.gz scummvm-rg350-10708f7a8d267ffaa89d739d42686fe12d26e92c.tar.bz2 scummvm-rg350-10708f7a8d267ffaa89d739d42686fe12d26e92c.zip | |
BLADERUNNER: Fix invalid read
Conditions are evaluated left to right. If you want short-
circuiting to protect from invalid read, you have to do the
range checks before the pointer dereferencing.
Diffstat (limited to 'engines/bladerunner/decompress_lcw.cpp')
| -rw-r--r-- | engines/bladerunner/decompress_lcw.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/engines/bladerunner/decompress_lcw.cpp b/engines/bladerunner/decompress_lcw.cpp index 15e28bf3af..8d20e231c7 100644 --- a/engines/bladerunner/decompress_lcw.cpp +++ b/engines/bladerunner/decompress_lcw.cpp @@ -40,7 +40,7 @@ uint32 decompress_lcw(uint8 *inBuf, uint32 inLen, uint8 *outBuf, uint32 outLen) ++src; } - while (src[0] != 0x80 && src < inBuf + inLen && dst < outEnd) + while (src < inBuf + inLen && dst < outEnd && src[0] != 0x80) { out_remain = (int)(outEnd - dst); |