From fa05b3a93533380391eb6a214aa613f013baa005 Mon Sep 17 00:00:00 2001
From: Gregory Montoir
Date: Fri, 27 Jan 2006 19:33:40 +0000
Subject: Fixed invalid memory reads in generateSubstResFileName.

svn-id: r20240
---
 scumm/resource.cpp |  7 ++++---
 scumm/scumm.cpp    | 10 +++++++---
 2 files changed, 11 insertions(+), 6 deletions(-)

(limited to 'scumm')

diff --git a/scumm/resource.cpp b/scumm/resource.cpp
index 46b420a2d0..15dd50fbfa 100644
--- a/scumm/resource.cpp
+++ b/scumm/resource.cpp
@@ -150,11 +150,12 @@ void ScummEngine::openRoom(const int room) {
 		// If we have substitute
 		if (_substResFileNameIndex > 0 && !(_platform == Common::kPlatformNES || _platform == Common::kPlatformC64)) {
 			char tmpBuf[128];
-
 			generateSubstResFileName(buf, tmpBuf, sizeof(tmpBuf));
 			strcpy(buf, tmpBuf);
-			generateSubstResFileName(buf2, tmpBuf, sizeof(tmpBuf));
-			strcpy(buf2, tmpBuf);
+			if (buf2[0]) {
+				generateSubstResFileName(buf2, tmpBuf, sizeof(tmpBuf));
+				strcpy(buf2, tmpBuf);
+			}
 		}
 
 		result = openResourceFile(buf, encByte);
diff --git a/scumm/scumm.cpp b/scumm/scumm.cpp
index 89275cf53e..fe0de5a8da 100644
--- a/scumm/scumm.cpp
+++ b/scumm/scumm.cpp
@@ -3183,16 +3183,20 @@ static int generateSubstResFileName_(const char *filename, char *buf, int bufsiz
 	if (index <= 0)
 		return -1;
 
-	char num = filename[strlen(filename) - 1];
+	size_t len = strlen(filename);
+	assert(len >= 5);
+
+	char num = filename[len - 1];
 
 	// In some cases we have .(a) and .(b) extensions
 	if (num == ')')
-		num = filename[strlen(filename) - 2];
+		num = filename[len - 2];
 
 	const char *ext = NULL;
 
 	ext = strrchr(filename, '.');
-	size_t len = (ext != NULL) ? ext - filename : strlen(filename);
+	if (ext)
+		len = ext - filename;
 
 	for (int i = index; substResFileNameTable[i].winName; i++) {
 		if (!scumm_strnicmp(filename, substResFileNameTable[i].winName, len)) {
-- 
cgit v1.2.3