diff options
| author | Florian Kagerer | 2008-05-07 21:04:06 +0000 |
|---|---|---|
| committer | Florian Kagerer | 2008-05-07 21:04:06 +0000 |
| commit | 37c04c28a8b9d3affc69db0161156f343fc8ab9f (patch) | |
| tree | dd12ecd51e096add3cc3ecbdab2989b156e3d49a /engines | |
| parent | b95db3529e57943ddf036550950642e584441a30 (diff) | |
| download | scummvm-rg350-37c04c28a8b9d3affc69db0161156f343fc8ab9f.tar.gz scummvm-rg350-37c04c28a8b9d3affc69db0161156f343fc8ab9f.tar.bz2 scummvm-rg350-37c04c28a8b9d3affc69db0161156f343fc8ab9f.zip | |
Fix invalid memory access bug in the library sequence (original static data seems to be bugged here)
svn-id: r31933
Diffstat (limited to 'engines')
| -rw-r--r-- | engines/kyra/staticres.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/engines/kyra/staticres.cpp b/engines/kyra/staticres.cpp index 59a64e3aba..8ace7288f2 100644 --- a/engines/kyra/staticres.cpp +++ b/engines/kyra/staticres.cpp @@ -728,6 +728,11 @@ bool StaticResource::loadHofSequenceData(const char *filename, void *&ptr, int & if (ctrlOffs) { int num_c = *(filePtr + ctrlOffs); const uint16 *in_c = (uint16*) (filePtr + ctrlOffs + 1); + // safety check for library sequence which is supposed to have + // one frame more than control entries (seems to be a bug in + // the original code). This caused invalid memory access . + if (tmp_n[i].endFrame > num_c) + tmp_n[i].endFrame = num_c; FrameControl *tmp_f = new FrameControl[num_c]; for (int ii = 0; ii < num_c; ii++) { |