SCI32: Fix out-of-bounds reads of truncated uncompressed cels

This happens e.g. on the About page in LSL7 because of an
interpreter problem where bitmap handles are destroyed and then
reused without a kFrameOut call to remove old screen items from
the visible plane list before a kIsOnMe call that causes the
engine to try to read from reused bitmap handles with different
contents and dimensions.

This replaces bad memory reads on the About page in LSL7 with an
assertion failure, until the problem with the About page can be
properly addressed.

1 files changed, 4 insertions, 1 deletions

diff --git a/engines/sci/graphics/celobj32.cpp b/engines/sci/graphics/celobj32.cpp
index 75f6280460..df55ec9567 100644
--- a/engines/sci/graphics/celobj32.cpp
+++ b/engines/sci/graphics/celobj32.cpp
@@ -263,7 +263,7 @@ int16 SCALER_Scale<FLIP, READER>::_valuesY[kCelScalerTableSize];
 struct READER_Uncompressed {
 private:
 #ifndef NDEBUG
-	const int16 _sourceHeight;
+	int16 _sourceHeight;
 #endif
 	const byte *_pixels;
 	const int16 _sourceWidth;
@@ -280,6 +280,9 @@ public:
 
 		if (numPixels < celObj._width * celObj._height) {
 			warning("%s is truncated", celObj._info.toString().c_str());
+#ifndef NDEBUG
+			_sourceHeight = numPixels / celObj._width;
+#endif
 		}
 
 		_pixels = resource.getUnsafeDataAt(pixelsOffset, numPixels);