From 0ccc9189402de806307ca9836196cf29f31b2ab7 Mon Sep 17 00:00:00 2001
From: Joel Teichroeb
Date: Sun, 27 Oct 2013 12:42:03 -0700
Subject: GUI: Fix for potential bad cursor palette access in warning case.

Previously, if the colorsFound exceeded the maximum number of
cursor colors, a bad access to the cursor palette buffer could be
performed before the warning was emitted. This reordering avoids
that.
---
 gui/ThemeEngine.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'gui')

diff --git a/gui/ThemeEngine.cpp b/gui/ThemeEngine.cpp
index 688654d208..9fe482ddcc 100644
--- a/gui/ThemeEngine.cpp
+++ b/gui/ThemeEngine.cpp
@@ -1360,17 +1360,17 @@ bool ThemeEngine::createCursor(const Common::String &filename, int hotspotX, int
 
 			// If there is no entry yet for this color in the palette: Add one
 			if (!colorToIndex.contains(col)) {
+				if (colorsFound >= MAX_CURS_COLORS) {
+					warning("Cursor contains too many colors (%d, but only %d are allowed)", colorsFound, MAX_CURS_COLORS);
+					return false;
+				}
+
 				const int index = colorsFound++;
 				colorToIndex[col] = index;
 
 				_cursorPal[index * 3 + 0] = r;
 				_cursorPal[index * 3 + 1] = g;
 				_cursorPal[index * 3 + 2] = b;
-
-				if (colorsFound > MAX_CURS_COLORS) {
-					warning("Cursor contains too many colors (%d, but only %d are allowed)", colorsFound, MAX_CURS_COLORS);
-					return false;
-				}
 			}
 
 			// Copy pixel from the 16 bit source surface to the 8bit target surface
-- 
cgit v1.2.3