aboutsummaryrefslogtreecommitdiff
path: root/engines
diff options
context:
space:
mode:
authorColin Snover2016-09-11 20:59:39 -0500
committerColin Snover2016-09-29 19:39:16 -0500
commit84d8ac4c38bd2aabbbc7ad85ae257db69ba33574 (patch)
tree65b05551bf9f9df60379b8ee9ad19b3265300a0f /engines
parent658fb7f8e4c9a43f3f5e21f6b572b2ff2c1cc974 (diff)
downloadscummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.tar.gz
scummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.tar.bz2
scummvm-rg350-84d8ac4c38bd2aabbbc7ad85ae257db69ba33574.zip
SCI32: Fix buffer overflow when drawing border to a tiny text bitmap
Diffstat (limited to 'engines')
-rw-r--r--engines/sci/graphics/text32.cpp9
1 files changed, 6 insertions, 3 deletions
diff --git a/engines/sci/graphics/text32.cpp b/engines/sci/graphics/text32.cpp
index 11572581ff..254c7d92e6 100644
--- a/engines/sci/graphics/text32.cpp
+++ b/engines/sci/graphics/text32.cpp
@@ -183,13 +183,15 @@ void GfxText32::drawFrame(const Common::Rect &rect, const int16 size, const uint
// NOTE: Not fully disassembled, but this should be right
int16 rectWidth = targetRect.width();
- int16 sidesHeight = targetRect.height() - size * 2;
+ int16 heightRemaining = targetRect.height();
+ int16 sidesHeight = heightRemaining - size * 2;
int16 centerWidth = rectWidth - size * 2;
int16 stride = _width - rectWidth;
- for (int16 y = 0; y < size; ++y) {
+ for (int16 y = 0; y < size && y < heightRemaining; ++y) {
memset(pixels, color, rectWidth);
pixels += _width;
+ --heightRemaining;
}
for (int16 y = 0; y < sidesHeight; ++y) {
for (int16 x = 0; x < size; ++x) {
@@ -201,9 +203,10 @@ void GfxText32::drawFrame(const Common::Rect &rect, const int16 size, const uint
}
pixels += stride;
}
- for (int16 y = 0; y < size; ++y) {
+ for (int16 y = 0; y < size && y < heightRemaining; ++y) {
memset(pixels, color, rectWidth);
pixels += _width;
+ --heightRemaining;
}
}