diff options
| author | Martin Kiewitz | 2016-01-30 23:08:19 +0100 |
|---|---|---|
| committer | Martin Kiewitz | 2016-01-30 23:08:19 +0100 |
| commit | cb3b5d5e31570d6b6757e6b5e414414972d1b5d6 (patch) | |
| tree | d7be0982b77025d16764d710c24e8d4cc1abc296 /engines | |
| parent | 98730cb962eef946b039bf5170cddccb7af6fbba (diff) | |
| download | scummvm-rg350-cb3b5d5e31570d6b6757e6b5e414414972d1b5d6.tar.gz scummvm-rg350-cb3b5d5e31570d6b6757e6b5e414414972d1b5d6.tar.bz2 scummvm-rg350-cb3b5d5e31570d6b6757e6b5e414414972d1b5d6.zip | |
AGI: fix agi256 view decompression
+ add extra security checks
Diffstat (limited to 'engines')
| -rw-r--r-- | engines/agi/view.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/engines/agi/view.cpp b/engines/agi/view.cpp index e9ed169eb7..3793272eb6 100644 --- a/engines/agi/view.cpp +++ b/engines/agi/view.cpp @@ -240,6 +240,9 @@ int AgiEngine::decodeView(byte *resourceData, uint16 resourceSize, int16 viewNr) celCompressedData = resourceData + celOffset + 3; celCompressedSize = resourceSize - (celOffset + 3); + if (celCompressedSize == 0) + error("compressed size of loop within view %d is 0 bytes", viewNr); + if (!isAGI256Data) { unpackViewCelData(celData, celCompressedData, celCompressedSize); } else { @@ -350,7 +353,7 @@ void AgiEngine::unpackViewCelDataAGI256(AgiViewCel *celData, byte *compressedDat while (remainingHeight) { if (!compressedSize) - error("unexpected end of data, while unpacking AGI256 data"); + error("unexpected end of data, while unpacking AGI256 view"); curByte = *compressedData++; compressedSize--; @@ -364,8 +367,13 @@ void AgiEngine::unpackViewCelDataAGI256(AgiViewCel *celData, byte *compressedDat remainingWidth = 0; } } else { + if (!remainingWidth) { + error("broken view data, while unpacking AGI256 view"); + break; + } *rawBitmap = curByte; rawBitmap++; + remainingWidth--; } if (curByte == 0) { |