From b01a58e82cd06e77533ae9209f9956ac6775127f Mon Sep 17 00:00:00 2001
From: Eugene Sandulenko
Date: Wed, 17 Aug 2016 11:39:42 +0200
Subject: DIRECTOR: Fix memory override

---
 engines/director/dib.cpp   | 2 +-
 engines/director/score.cpp | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'engines')

diff --git a/engines/director/dib.cpp b/engines/director/dib.cpp
index 8c54ba5363..04665e7d34 100644
--- a/engines/director/dib.cpp
+++ b/engines/director/dib.cpp
@@ -62,7 +62,7 @@ void DIBDecoder::loadPalette(Common::SeekableReadStream &stream) {
 	uint16 steps = stream.size() / 6;
 	uint16 index = (steps * 3) - 1;
 	_paletteColorCount = steps;
-	_palette = new byte[index];
+	_palette = new byte[index + 1];
 
 	for (uint8 i = 0; i < steps; i++) {
 		_palette[index - 2] = stream.readByte();
diff --git a/engines/director/score.cpp b/engines/director/score.cpp
index bd3def53c6..7a2f8f7c8c 100644
--- a/engines/director/score.cpp
+++ b/engines/director/score.cpp
@@ -201,7 +201,7 @@ void Score::loadPalette(Common::SeekableSubReadStreamEndian &stream) {
 	uint16 steps = stream.size() / 6;
 	uint16 index = (steps * 3) - 1;
 	uint16 _paletteColorCount = steps;
-	byte *_palette = new byte[index];
+	byte *_palette = new byte[index + 1];
 
 	for (uint8 i = 0; i < steps; i++) {
 		_palette[index - 2] = stream.readByte();
-- 
cgit v1.2.3