[Scummvm-cvs-logs] SF.net SVN: scummvm: [22331] scummvm/trunk/engines/simon/vga.cpp

[kirben at users.sourceforge.net]

Revision: 22331
Author:   kirben
Date:     2006-05-03 23:28:51 -0700 (Wed, 03 May 2006)
ViewCVS:  http://svn.sourceforge.net/scummvm/?rev=22331&view=rev

Log Message:
-----------
Don't read beyond animationCount, when looking for animation in vc3_loadSprite()

Modified Paths:
--------------
    scummvm/trunk/engines/simon/vga.cpp
Modified: scummvm/trunk/engines/simon/vga.cpp
===================================================================
--- scummvm/trunk/engines/simon/vga.cpp	2006-05-04 06:18:19 UTC (rev 22330)
+++ scummvm/trunk/engines/simon/vga.cpp	2006-05-04 06:28:51 UTC (rev 22331)
@@ -367,7 +367,7 @@
 
 void SimonEngine::vc3_loadSprite() {
 	uint16 windowNum, zoneNum, palette, x, y, vgaSpriteId;
-	uint16 res;
+	uint16 count, res;
 	VgaSprite *vsp;
 	VgaPointersEntry *vpe;
 	byte *p, *pp;
@@ -423,16 +423,26 @@
 	pp = _curVgaFile1;
 	if (getGameType() == GType_FF) {
 		p = pp + READ_LE_UINT16(&((VgaFileHeader_Feeble *) pp)->hdr2_start);
+		count = READ_LE_UINT16(&((VgaFileHeader2_Feeble *) p)->animationCount);
 		p = pp + READ_LE_UINT16(&((VgaFileHeader2_Feeble *) p)->animationTable);
 
-		while (READ_LE_UINT16(&((AnimationHeader_Feeble *) p)->id) != vgaSpriteId)
+		while (count--) {
+			if (READ_LE_UINT16(&((AnimationHeader_Feeble *) p)->id) == vgaSpriteId)
+				break;
 			p += sizeof(AnimationHeader_Feeble);
+		}
+		assert(READ_LE_UINT16(&((AnimationHeader_Feeble *) p)->id) == vgaSpriteId);
 	} else {
 		p = pp + READ_BE_UINT16(&((VgaFileHeader_Simon *) pp)->hdr2_start);
+		count = READ_BE_UINT16(&((VgaFileHeader2_Simon *) p)->animationCount);
 		p = pp + READ_BE_UINT16(&((VgaFileHeader2_Simon *) p)->animationTable);
 
-		while (READ_BE_UINT16(&((AnimationHeader_Simon *) p)->id) != vgaSpriteId)
+		while (count--) {
+			if (READ_BE_UINT16(&((AnimationHeader_Simon *) p)->id) == vgaSpriteId)
+				break;
 			p += sizeof(AnimationHeader_Simon);
+		}
+		assert(READ_BE_UINT16(&((AnimationHeader_Simon *) p)->id) == vgaSpriteId);
 	}
 
 #ifdef DUMP_FILE_NR


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.