From 7c95deb5b6f1311fb34c095fc4df3c979a893f50 Mon Sep 17 00:00:00 2001
From: Peter Helbing
Date: Fri, 7 Jun 2019 22:19:06 +0200
Subject: XEEN: Check bounds of stat values array, bug #10971

---
 engines/xeen/character.cpp                 | 5 +++--
 engines/xeen/dialogs/dialogs_char_info.cpp | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

(limited to 'engines/xeen')

diff --git a/engines/xeen/character.cpp b/engines/xeen/character.cpp
index afc013ba89..47ef0b8ecd 100644
--- a/engines/xeen/character.cpp
+++ b/engines/xeen/character.cpp
@@ -418,8 +418,9 @@ int Character::statColor(int amount, int threshold) {
 
 int Character::statBonus(uint statValue) const {
 	int idx;
-	for (idx = 0; Res.STAT_VALUES[idx] <= (int)statValue; ++idx)
-		;
+	for (idx = 0; idx < ARRAYSIZE(Res.STAT_VALUES) - 1; ++idx)
+		if (Res.STAT_VALUES[idx] > (int)statValue)
+			break;
 
 	return Res.STAT_BONUSES[idx];
 }
diff --git a/engines/xeen/dialogs/dialogs_char_info.cpp b/engines/xeen/dialogs/dialogs_char_info.cpp
index aec8be5ee4..3923caf172 100644
--- a/engines/xeen/dialogs/dialogs_char_info.cpp
+++ b/engines/xeen/dialogs/dialogs_char_info.cpp
@@ -359,9 +359,9 @@ bool CharacterInfo::expandStat(int attrib, const Character &c) {
 		// Basic attributes
 		stat1 = c.getStat((Attribute)attrib, false);
 		stat2 = c.getStat((Attribute)attrib, true);
-		idx = 0;
-		while (Res.STAT_VALUES[idx] <= (int)stat1)
-			++idx;
+		for (idx = 0; idx < ARRAYSIZE(Res.STAT_VALUES) - 1; ++idx)
+			if (Res.STAT_VALUES[idx] > (int)stat1)
+				break;
 
 		msg = Common::String::format(Res.CURRENT_MAXIMUM_RATING_TEXT, Res.STAT_NAMES[attrib],
 			stat1, stat2, Res.RATING_TEXT[idx]);
-- 
cgit v1.2.3