DREAMWEB: Make frame fixups more specific and add sanity checks

This should detect (and trigger asserts on) the kind of ex frame
data corruption in bug #3591088.

1 files changed, 17 insertions, 4 deletions

diff --git a/engines/dreamweb/object.cpp b/engines/dreamweb/object.cpp
index 458630753c..ecd38f2abe 100644
--- a/engines/dreamweb/object.cpp
+++ b/engines/dreamweb/object.cpp
@@ -435,10 +435,23 @@ void DreamWebEngine::deleteExFrame(uint8 frameNum) {
 	_vars._exFramePos -= frameSize;
 
 	// Adjust all frame pointers pointing into the shifted data
-	for (unsigned int i = 0; i < 3*kNumexobjects; ++i) {
-		frame = &_exFrames._frames[i];
-		if (frame->ptr() >= startOff)
-			frame->setPtr(frame->ptr() - frameSize);
+	for (unsigned int i = 0; i < kNumexobjects; ++i) {
+		if (_exData[i].mapad[0] != 0xff) {
+			frame = &_exFrames._frames[3*i+0];
+			if (frame->ptr() >= startOff) {
+				frame->setPtr(frame->ptr() - frameSize);
+				assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos);
+			} else {
+				assert(frame->ptr() + frame->width*frame->height <= startOff);
+			}
+			frame = &_exFrames._frames[3*i+1];
+			if (frame->ptr() >= startOff) {
+				frame->setPtr(frame->ptr() - frameSize);
+				assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos);
+			} else {
+				assert(frame->ptr() + frame->width*frame->height <= startOff);
+			}
+		}
 	}
 }