[Scummvm-tracker] [ScummVM] #9605: SCI: QFG3 (GOG): Uninitialized read on stats screen in Simbani bridge room

[Omer Mor]

#9605: SCI: QFG3 (GOG): Uninitialized read on stats screen in Simbani bridge room
--------------------------------+-------------------------
  Reporter:  wjp                |      Owner:
      Type:  defect             |     Status:  new
  Priority:  normal             |  Component:  Engine: SCI
Resolution:                     |   Keywords:
      Game:  Quest for Glory 3  |
--------------------------------+-------------------------

Comment (by OmerMor):

 Here's the decompiled `rm470::notify()` method (using SCI Companion):

 {{{
 (method (notify param1 param2 &tmp temp0)
         (switch param1
                 (1
                         (if (> argc 1) (= local6 param2))
                         (= temp0 local6)
                 )
                 (3
                         (if (> argc 1)
                                 (= local0 param2)
                                 (switch param2
                                         (3
                                                 (= [local61 0] @local48)
                                                 (uhuraTeller init:
 (ScriptID 34 1) @local48 local61)
                                         )
                                         (4
                                                 (= [local61 0] @local53)
                                                 (uhuraTeller init:
 (ScriptID 34 1) @local53 local61)
                                         )
                                         (10 ((ScriptID 34 1) dispose:))
                                 )
                         )
                         (= temp0 local0)
                 )
         )
         (return temp0)
 )
 }}}

 So it's seems like when `param1` != {1,3}, `temp0` won't be assigned
 before the functions returns it, which would explain the crash.


 In `charSheet::doit()`, there's only one call to notify:

 {{{
 (global2 notify: -15)
 }}}

 Where `global2` hold the current room, which would be `rm470` - the
 Simbani bridge room.

--
Ticket URL: <https://bugs.scummvm.org/ticket/9605#comment:1>
ScummVM <https://bugs.scummvm.org>
ScummVM