diff options
| author | Joseph-Eugene Winzer | 2017-06-12 11:11:35 +0200 |
|---|---|---|
| committer | Thierry Crozat | 2018-01-22 21:16:37 +0000 |
| commit | 8e55efa748c1d3d73b261b53b9feadcc5384801d (patch) | |
| tree | e44800a92219f051526c201343fcfeb1101e684d /engines/supernova | |
| parent | 0c72f52ad880279037004e78f36c302d5422b53f (diff) | |
| download | scummvm-rg350-8e55efa748c1d3d73b261b53b9feadcc5384801d.tar.gz scummvm-rg350-8e55efa748c1d3d73b261b53b9feadcc5384801d.tar.bz2 scummvm-rg350-8e55efa748c1d3d73b261b53b9feadcc5384801d.zip | |
SUPERNOVA: Fix OOB write in paletteBrightness()
Palette color 255 doesn't seem to be used
Diffstat (limited to 'engines/supernova')
| -rw-r--r-- | engines/supernova/graphics.cpp | 2 | ||||
| -rw-r--r-- | engines/supernova/supernova.cpp | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/engines/supernova/graphics.cpp b/engines/supernova/graphics.cpp index d0d26eb809..225e2e72f2 100644 --- a/engines/supernova/graphics.cpp +++ b/engines/supernova/graphics.cpp @@ -30,7 +30,7 @@ bool MSNImageDecoder::loadStream(Common::SeekableReadStream &stream) { _encodedImage = new byte[size]; _palette = new byte[717]; - g_system->getPaletteManager()->grabPalette(_palette, 16, 240); + g_system->getPaletteManager()->grabPalette(_palette, 16, 239); byte pal_diff; byte flag = stream.readByte(); diff --git a/engines/supernova/supernova.cpp b/engines/supernova/supernova.cpp index 69fcea588c..c694fdfb8e 100644 --- a/engines/supernova/supernova.cpp +++ b/engines/supernova/supernova.cpp @@ -306,20 +306,20 @@ void SupernovaEngine::renderBox(int x, int y, int width, int height, byte color) void SupernovaEngine::paletteBrightness() { byte palette[768]; - _system->getPaletteManager()->grabPalette(palette, 0, 256); + _system->getPaletteManager()->grabPalette(palette, 0, 255); for (size_t i = 0; i < 48; ++i) { palette[i] = (initVGAPalette[i] * _menuBrightness) >> 8; } - for (size_t i = 48; i < 768; ++i) { + for (size_t i = 0; i < 717; ++i) { const byte *imagePalette; if (_image.getPalette()) { imagePalette = _image.getPalette(); } else { imagePalette = palette; } - palette[i] = (imagePalette[i - 48] * _brightness) >> 8; + palette[i + 48] = (imagePalette[i] * _brightness) >> 8; } - _system->getPaletteManager()->setPalette(palette, 0, 256); + _system->getPaletteManager()->setPalette(palette, 0, 255); } void SupernovaEngine::paletteFadeOut() { |