From f8ef5ee55fba7dc9c6019533d3e394bf5302d69d Mon Sep 17 00:00:00 2001
From: James Brown
Date: Wed, 8 Jan 2003 22:31:35 +0000
Subject: subcode lvl3:0xFD fix. this sub writes into oob+1 memory :/

svn-id: r6360
---
 scumm/smush/codec47.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/scumm/smush/codec47.cpp b/scumm/smush/codec47.cpp
index 07419576be..46dc15c7b1 100644
--- a/scumm/smush/codec47.cpp
+++ b/scumm/smush/codec47.cpp
@@ -772,8 +772,6 @@ static void codec47_subgfx_lev3() {
 		return;
 	}
 	if (code == 0xFD) {
-		d_src += 4;
-		return;
 		byte * tmp_ptr = (*(d_src + 1) << 7) + (byte*)codec47_decode2_buf2;
 		int32 l = *(tmp_ptr + 96);
 		byte val = *(d_src + 2);
@@ -781,14 +779,14 @@ static void codec47_subgfx_lev3() {
 		do {
 			*(d_dst + *(tmp_ptr2)) = val;
 			tmp_ptr2++;
-		} while (--l);
+		} while (--l > 0);
 		l = *(tmp_ptr + 97);
 		val = *(d_src + 3);
 		tmp_ptr2 = (int16*)(tmp_ptr + 32);
 		do {
 			*(d_dst + *(tmp_ptr2)) = val;
 			tmp_ptr2++;
-		} while (--l);
+		} while (--l > 0);
 		d_src += 4;
 		return;
 	}
@@ -991,7 +989,7 @@ bool Codec47Decoder::initSize(const Point & p, const Rect & r) {
 
 		int32 frame_size = getRect().width() * getRect().height();
 		_deltaSize = frame_size * 3;
-		_deltaBuf = new byte[_deltaSize + 1000000];
+		_deltaBuf = new byte[_deltaSize];
 		_deltaBufs[0] = _deltaBuf;
 		_deltaBufs[1] = _deltaBuf + frame_size;
 		_curBuf = _deltaBuf + frame_size * 2;
-- 
cgit v1.2.3