diff options
| author | D G Turner | 2019-10-05 00:38:40 +0100 |
|---|---|---|
| committer | D G Turner | 2019-10-05 00:38:40 +0100 |
| commit | 3911b564448417cf52e7153339f3cb1714d0917d (patch) | |
| tree | 26ab9eb260d66c4bd0cc75c9a5561ca96a4377b3 /graphics/macgui | |
| parent | 452b380976bd27874b42087b835007d880b75c08 (diff) | |
| download | scummvm-rg350-3911b564448417cf52e7153339f3cb1714d0917d.tar.gz scummvm-rg350-3911b564448417cf52e7153339f3cb1714d0917d.tar.bz2 scummvm-rg350-3911b564448417cf52e7153339f3cb1714d0917d.zip | |
GRAPHICS: MACGUI: Fix Possible Out of Bounds Read with Trailing Ampersand
Since the ampersand is used as an escape character, it is repeated when
it actually appears in the string. Unfortunately, this requires a one
character lookahead which could result in reading beyond the string if
this ampersand is the last character (which would be malformed, but
possible). To avoid an out of bounds read, this is now qualified by
the string length. Trailing ampersands will now be ignored without issue.
Diffstat (limited to 'graphics/macgui')
| -rw-r--r-- | graphics/macgui/macmenu.cpp | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/graphics/macgui/macmenu.cpp b/graphics/macgui/macmenu.cpp index 2f95d012d5..d8fc4a6464 100644 --- a/graphics/macgui/macmenu.cpp +++ b/graphics/macgui/macmenu.cpp @@ -368,11 +368,13 @@ int MacMenu::addMenuItem(MacMenuSubMenu *submenu, const Common::U32String &text, for (uint i = 0; i < text.size(); i++) if (text[i] == amp[0]) { - if ((text[i + 1] & 0xff) != '&') { - shortcut = text[i + 1] & 0xff; - shortcutPos = i; - } else { - res += text[i]; + if (i < text.size() - 1) { + if ((text[i + 1] & 0xff) != '&') { + shortcut = text[i + 1] & 0xff; + shortcutPos = i; + } else { + res += text[i]; + } } } else { res += text[i]; |