From 4e4074f393acff806bd18cf56eeafc572acceb96 Mon Sep 17 00:00:00 2001
From: Johannes Schickel
Date: Tue, 15 Sep 2009 00:03:21 +0000
Subject: Fix valgrind warning inside "saturatedAddColor", when using the same
 palette object as both source and destination.

svn-id: r44094
---
 engines/cine/pal.cpp       | 16 ++++++++++++++--
 engines/cine/script_fw.cpp |  6 +++---
 2 files changed, 17 insertions(+), 5 deletions(-)

(limited to 'engines/cine')

diff --git a/engines/cine/pal.cpp b/engines/cine/pal.cpp
index 757419ef87..01a7c20d25 100644
--- a/engines/cine/pal.cpp
+++ b/engines/cine/pal.cpp
@@ -214,8 +214,20 @@ Palette &Palette::saturatedAddColor(Palette& output, byte firstIndex, byte lastI
 	assert(firstIndex < output.colorCount() && lastIndex < output.colorCount());
 	assert(output.colorFormat() == colorFormat());
 
-	for (uint i = firstIndex; i <= lastIndex; i++)
-		output._colors[i] = saturatedAddColor(_colors[i], r, g, b);
+	for (uint i = firstIndex; i <= lastIndex; i++) {
+		// WORKAROUND for a valgrind warning on AMD64:
+		//
+		// The old code read: "output._colors[i] = saturatedAddColor(_colors[i], r, g, b);".
+		//
+		// It seems g++ 4.1.2, 4.3.4 and 4.4.1 do a 8 byte read when passing _colors[i] as parameter,
+		// even though the struct is only 3 bytes, resulting in an invalid read, when accessing indices
+		// 14 and 15 of 16 color palettes.
+		//
+		// To work around this issue, we added an temporary variable, which will have padding so
+		// the 8 byte read (which is done when passing src) is assured to be in a valid memory area.
+		const Color src = _colors[i];
+		output._colors[i] = saturatedAddColor(src, r, g, b);
+	}
 
 	return output;
 }
diff --git a/engines/cine/script_fw.cpp b/engines/cine/script_fw.cpp
index e926027f68..ff7952bef8 100644
--- a/engines/cine/script_fw.cpp
+++ b/engines/cine/script_fw.cpp
@@ -1405,14 +1405,14 @@ int FWScript::o1_fadeToBlack() {
 
 int FWScript::o1_transformPaletteRange() {
 	byte startColor = getNextByte();
-	byte numColor = getNextByte();
+	byte endColor = getNextByte();
 	int16 r = getNextWord();
 	int16 g = getNextWord();
 	int16 b = getNextWord();
 
-	debugC(5, kCineDebugScript, "Line: %d: transformPaletteRange(from:%d,numIdx:%d,r:%d,g:%d,b:%d)", _line, startColor, numColor, r, g, b);
+	debugC(5, kCineDebugScript, "Line: %d: transformPaletteRange(from:%d,to:%d,r:%d,g:%d,b:%d)", _line, startColor, endColor, r, g, b);
 
-	renderer->transformPalette(startColor, numColor, r, g, b);
+	renderer->transformPalette(startColor, endColor, r, g, b);
 	return 0;
 }
 
-- 
cgit v1.2.3