Only decompress the number of speech samples indicated by 'resSize'. This

prevents crashes in the demo, and is probably a good idea anyway.

svn-id: r23917

1 files changed, 11 insertions, 5 deletions

diff --git a/engines/sword1/sound.cpp b/engines/sword1/sound.cpp
index c2576ee7d4..f699a4c475 100644
--- a/engines/sword1/sound.cpp
+++ b/engines/sword1/sound.cpp
@@ -260,24 +260,30 @@ int16 *Sound::uncompressSpeech(uint32 index, uint32 cSize, uint32 *size) {
 		uint32 srcPos = headerPos >> 1;
 		cSize /= 2;
 		uint32 dstPos = 0;
-		/* alloc 200 additional bytes, as the demo sometimes has ASCII junk
-		   at the end of the wave data */
-		int16 *dstData = (int16*)malloc(resSize * 2 + 200);
-		while (srcPos < cSize) {
+		int16 *dstData = (int16*)malloc(resSize * 2);
+		int32 samplesLeft = resSize;
+		while (srcPos < cSize && samplesLeft > 0) {
 			int16 length = (int16)READ_LE_UINT16(srcData + srcPos);
 			srcPos++;
 			if (length < 0) {
 				length = -length;
+				if (length > samplesLeft)
+					length = samplesLeft;
 				for (uint16 cnt = 0; cnt < (uint16)length; cnt++)
 					dstData[dstPos++] = srcData[srcPos];
 				srcPos++;
 			} else {
+				if (length > samplesLeft)
+					length = samplesLeft;
 				memcpy(dstData + dstPos, srcData + srcPos, length * 2);
 				dstPos += length;
 				srcPos += length;
 			}
+			samplesLeft -= length;
+		}
+		if (samplesLeft > 0) {
+			memset(dstData + dstPos, 0, samplesLeft * 2);
 		}
-		assert(dstPos < (uint32)resSize + 100);
 		if (_cowMode == CowDemo) // demo has wave output size embedded in the compressed data
 			*(uint32*)dstData = 0;
 		free(fBuf);