From f2fe1b775a4e344b51ada17415e125998a582efd Mon Sep 17 00:00:00 2001
From: Willem Jan Palenstijn
Date: Fri, 30 Nov 2012 16:10:18 +0100
Subject: DREAMWEB: Make frame fixups more specific and add sanity checks

This should detect (and trigger asserts on) the kind of ex frame
data corruption in bug #3591088.
---
 engines/dreamweb/object.cpp | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

(limited to 'engines')

diff --git a/engines/dreamweb/object.cpp b/engines/dreamweb/object.cpp
index 458630753c..ecd38f2abe 100644
--- a/engines/dreamweb/object.cpp
+++ b/engines/dreamweb/object.cpp
@@ -435,10 +435,23 @@ void DreamWebEngine::deleteExFrame(uint8 frameNum) {
 	_vars._exFramePos -= frameSize;
 
 	// Adjust all frame pointers pointing into the shifted data
-	for (unsigned int i = 0; i < 3*kNumexobjects; ++i) {
-		frame = &_exFrames._frames[i];
-		if (frame->ptr() >= startOff)
-			frame->setPtr(frame->ptr() - frameSize);
+	for (unsigned int i = 0; i < kNumexobjects; ++i) {
+		if (_exData[i].mapad[0] != 0xff) {
+			frame = &_exFrames._frames[3*i+0];
+			if (frame->ptr() >= startOff) {
+				frame->setPtr(frame->ptr() - frameSize);
+				assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos);
+			} else {
+				assert(frame->ptr() + frame->width*frame->height <= startOff);
+			}
+			frame = &_exFrames._frames[3*i+1];
+			if (frame->ptr() >= startOff) {
+				frame->setPtr(frame->ptr() - frameSize);
+				assert(frame->ptr() + frame->width*frame->height <= _vars._exFramePos);
+			} else {
+				assert(frame->ptr() + frame->width*frame->height <= startOff);
+			}
+		}
 	}
 }
 
-- 
cgit v1.2.3