From 3e8380f2c6889c85e0e962631eaf9814c2f84963 Mon Sep 17 00:00:00 2001
From: Torbjörn Andersson
Date: Sun, 17 Sep 2006 15:25:59 +0000
Subject: Only decompress the number of speech samples indicated by 'resSize'.
 This prevents crashes in the demo, and is probably a good idea anyway.

svn-id: r23917
---
 engines/sword1/sound.cpp | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

(limited to 'engines/sword1')

diff --git a/engines/sword1/sound.cpp b/engines/sword1/sound.cpp
index c2576ee7d4..f699a4c475 100644
--- a/engines/sword1/sound.cpp
+++ b/engines/sword1/sound.cpp
@@ -260,24 +260,30 @@ int16 *Sound::uncompressSpeech(uint32 index, uint32 cSize, uint32 *size) {
 		uint32 srcPos = headerPos >> 1;
 		cSize /= 2;
 		uint32 dstPos = 0;
-		/* alloc 200 additional bytes, as the demo sometimes has ASCII junk
-		   at the end of the wave data */
-		int16 *dstData = (int16*)malloc(resSize * 2 + 200);
-		while (srcPos < cSize) {
+		int16 *dstData = (int16*)malloc(resSize * 2);
+		int32 samplesLeft = resSize;
+		while (srcPos < cSize && samplesLeft > 0) {
 			int16 length = (int16)READ_LE_UINT16(srcData + srcPos);
 			srcPos++;
 			if (length < 0) {
 				length = -length;
+				if (length > samplesLeft)
+					length = samplesLeft;
 				for (uint16 cnt = 0; cnt < (uint16)length; cnt++)
 					dstData[dstPos++] = srcData[srcPos];
 				srcPos++;
 			} else {
+				if (length > samplesLeft)
+					length = samplesLeft;
 				memcpy(dstData + dstPos, srcData + srcPos, length * 2);
 				dstPos += length;
 				srcPos += length;
 			}
+			samplesLeft -= length;
+		}
+		if (samplesLeft > 0) {
+			memset(dstData + dstPos, 0, samplesLeft * 2);
 		}
-		assert(dstPos < (uint32)resSize + 100);
 		if (_cowMode == CowDemo) // demo has wave output size embedded in the compressed data
 			*(uint32*)dstData = 0;
 		free(fBuf);
-- 
cgit v1.2.3