diff options
author | Colin Snover | 2016-03-18 10:40:42 -0500 |
---|---|---|
committer | Colin Snover | 2016-03-18 11:10:49 -0500 |
commit | 856f3ae6489b3f9aec62043c58c3961baf619f16 (patch) | |
tree | 5073b077c5c83c2c5348daaa50563bf5c673b381 /engines/sci/engine/kstring.cpp | |
parent | b7d5dd9187d472df73075c2bb92d0a4f71726df7 (diff) | |
download | scummvm-rg350-856f3ae6489b3f9aec62043c58c3961baf619f16.tar.gz scummvm-rg350-856f3ae6489b3f9aec62043c58c3961baf619f16.tar.bz2 scummvm-rg350-856f3ae6489b3f9aec62043c58c3961baf619f16.zip |
SCI32: More correctly fix kStringCopy overflow
This entire kString code needs to be reviewed/refactored, but
at least this fix is more complete than the last one.
Thanks to @lordhoto and @wjp for their assistance.
Diffstat (limited to 'engines/sci/engine/kstring.cpp')
-rw-r--r-- | engines/sci/engine/kstring.cpp | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/engines/sci/engine/kstring.cpp b/engines/sci/engine/kstring.cpp index 6d61ad5f41..1c08bf597c 100644 --- a/engines/sci/engine/kstring.cpp +++ b/engines/sci/engine/kstring.cpp @@ -765,11 +765,14 @@ reg_t kStringCopy(EngineState *s, int argc, reg_t *argv) { } // The original engine ignores bad copies too - if (index2 > string2Size) + if (index2 >= string2Size) return NULL_REG; // A count of -1 means fill the rest of the array - uint32 count = argv[4].toSint16() == -1 ? string2Size - index2 + 1 : argv[4].toUint16(); + uint32 count = string2Size - index2; + if (argv[4].toSint16() != -1) { + count = MIN(count, (uint32)argv[4].toUint16()); + } // reg_t strAddress = argv[0]; SciString *string1 = s->_segMan->lookupString(argv[0]); @@ -781,8 +784,7 @@ reg_t kStringCopy(EngineState *s, int argc, reg_t *argv) { // Note: We're accessing from c_str() here because the // string's size ignores the trailing 0 and therefore // triggers an assert when doing string2[i + index2]. - uint16 size = MIN(string2Size, count); - for (uint16 i = 0; i < size; i++) + for (uint16 i = 0; i < count; i++) string1->setValue(i + index1, string2[i + index2]); return argv[0]; |