From d61f3d7601bc562de5806ceb307587dfa23c298b Mon Sep 17 00:00:00 2001
From: Max Horn
Date: Sun, 23 Dec 2007 16:02:58 +0000
Subject: Fix for bug #1837375: MM: Walk behind mask char data

svn-id: r29963
---
 engines/scumm/gfx.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/engines/scumm/gfx.cpp b/engines/scumm/gfx.cpp
index 17eedb24ee..f6a2385b4d 100644
--- a/engines/scumm/gfx.cpp
+++ b/engines/scumm/gfx.cpp
@@ -263,7 +263,11 @@ void GdiV1::roomChanged(byte *roomptr) {
 	decodeC64Gfx(roomptr + READ_LE_UINT16(roomptr + 12), _C64.picMap, roomptr[4] * roomptr[5]);
 	decodeC64Gfx(roomptr + READ_LE_UINT16(roomptr + 14), _C64.colorMap, roomptr[4] * roomptr[5]);
 	decodeC64Gfx(roomptr + READ_LE_UINT16(roomptr + 16), _C64.maskMap, roomptr[4] * roomptr[5]);
-	decodeC64Gfx(roomptr + READ_LE_UINT16(roomptr + 18) + 2, _C64.maskChar, READ_LE_UINT16(roomptr + READ_LE_UINT16(roomptr + 18)));
+	
+	// Read the mask data. The 16bit length value seems to always be 8 too big.
+	// See bug #1837375 for details on this.
+	const byte *maskPtr = roomptr + READ_LE_UINT16(roomptr + 18);
+	decodeC64Gfx(maskPtr + 2, _C64.maskChar, READ_LE_UINT16(maskPtr) - 8);
 	_objectMode = true;
 }
 
-- 
cgit v1.2.3