diff options
| author | Colin Snover | 2017-01-26 13:19:26 -0600 |
|---|---|---|
| committer | Colin Snover | 2017-03-30 19:46:27 -0500 |
| commit | 2d0c1c8ab50862136cf4c5c75e016a1def90c3e4 (patch) | |
| tree | e21da57367076c9bc724459a89f0a3ffd7e3d525 /engines | |
| parent | 5e81db8fd09d1783bd9503ac875eb36d9d1b3b80 (diff) | |
| download | scummvm-rg350-2d0c1c8ab50862136cf4c5c75e016a1def90c3e4.tar.gz scummvm-rg350-2d0c1c8ab50862136cf4c5c75e016a1def90c3e4.tar.bz2 scummvm-rg350-2d0c1c8ab50862136cf4c5c75e016a1def90c3e4.zip | |
SCI: Ensure object name reg_ts are valid before dereferencing them
Diffstat (limited to 'engines')
| -rw-r--r-- | engines/sci/engine/seg_manager.cpp | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/engines/sci/engine/seg_manager.cpp b/engines/sci/engine/seg_manager.cpp index 3157c84f85..12625691fd 100644 --- a/engines/sci/engine/seg_manager.cpp +++ b/engines/sci/engine/seg_manager.cpp @@ -272,9 +272,23 @@ const char *SegManager::getObjectName(reg_t pos) { if (nameReg.isNull()) return "<no name>"; - const char *name = 0; - if (nameReg.getSegment()) - name = derefString(nameReg); + const char *name = nullptr; + + if (nameReg.getSegment()) { +#ifdef ENABLE_SCI32 + // At least Torin script 64000 creates objects with names that are + // pointed to dynamically generated strings which are freed before the + // objects themselves are freed. This causes a crash when using + // `findObjectByName`, since the name of the object is no longer valid + if (nameReg.getSegment() != _arraysSegId || + _heap[_arraysSegId]->isValidOffset(nameReg.getOffset())) { +#endif + name = derefString(nameReg); +#ifdef ENABLE_SCI32 + } +#endif + } + if (!name) { // Crazy Nick Laura Bow is missing some object names needed for the static // selector vocabulary |