diff options
| author | Filippos Karapetis | 2011-09-26 15:22:48 +0300 |
|---|---|---|
| committer | Filippos Karapetis | 2011-09-26 15:22:48 +0300 |
| commit | 420c9f5550aedd89779daeb6c3d8397dc6107720 (patch) | |
| tree | a621b9c50e1bd29c208b2158c227e4354f5bb4a4 /engines | |
| parent | 686a328b48482e157eac4d59057f769de228a2a9 (diff) | |
| download | scummvm-rg350-420c9f5550aedd89779daeb6c3d8397dc6107720.tar.gz scummvm-rg350-420c9f5550aedd89779daeb6c3d8397dc6107720.tar.bz2 scummvm-rg350-420c9f5550aedd89779daeb6c3d8397dc6107720.zip | |
AGI: Fixed invalid memory writes in wordWrapString()
Diffstat (limited to 'engines')
| -rw-r--r-- | engines/agi/text.cpp | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/engines/agi/text.cpp b/engines/agi/text.cpp index 6bba90d856..2a159b5d03 100644 --- a/engines/agi/text.cpp +++ b/engines/agi/text.cpp @@ -225,8 +225,10 @@ char *AgiEngine::wordWrapString(const char *s, int *len) { const char *pWord; int lnLen, wLen; - // FIXME: outStr may end up being longer than s, so this can overflow - msgBuf = outStr = strdup(s); + // Allocate some extra space for the final buffer, as + // outStr may end up being longer than s + // 26 = 200 (screen height) / 8 (font height) + 1 + msgBuf = outStr = (char *)malloc(strlen(s) + 26); int msgWidth = 0; |