[Scummvm-cvs-logs] SF.net SVN: scummvm:[41305] scummvm/trunk/engines/gob

[fingolfin at users.sourceforge.net]

Revision: 41305
          http://scummvm.svn.sourceforge.net/scummvm/?rev=41305&view=rev
Author:   fingolfin
Date:     2009-06-06 21:37:30 +0000 (Sat, 06 Jun 2009)

Log Message:
-----------
GOB: Turned _spritesArray into a Common::Array (of fixed size) to detect out-of-bounds access to it (since access is controlled by scripts, this could (and does :/) easily happen. Also removed an obsolete swap() method, and fixed one case where _spritesArray was indeed accessed out of bounds

Modified Paths:
--------------
    scummvm/trunk/engines/gob/draw.cpp
    scummvm/trunk/engines/gob/draw.h
    scummvm/trunk/engines/gob/inter_v1.cpp
    scummvm/trunk/engines/gob/video.h

Modified: scummvm/trunk/engines/gob/draw.cpp
===================================================================
--- scummvm/trunk/engines/gob/draw.cpp	2009-06-06 20:58:36 UTC (rev 41304)
+++ scummvm/trunk/engines/gob/draw.cpp	2009-06-06 21:37:30 UTC (rev 41305)
@@ -62,6 +62,8 @@
 	for (int i = 0; i < 8; i++)
 		_fonts[i] = 0;
 
+	_spritesArray.resize(SPRITES_COUNT);
+
 	_invalidatedCount = 0;
 	for (int i = 0; i < 30; i++) {
 		_invalidatedTops[i] = 0;

Modified: scummvm/trunk/engines/gob/draw.h
===================================================================
--- scummvm/trunk/engines/gob/draw.h	2009-06-06 20:58:36 UTC (rev 41304)
+++ scummvm/trunk/engines/gob/draw.h	2009-06-06 21:37:30 UTC (rev 41305)
@@ -78,7 +78,7 @@
 	FontToSprite _fontToSprite[4];
 	Video::FontDesc *_fonts[8];
 
-	SurfaceDescPtr _spritesArray[SPRITES_COUNT];
+	Common::Array<SurfaceDescPtr> _spritesArray;
 
 	int16 _invalidatedCount;
 	int16 _invalidatedTops[30];

Modified: scummvm/trunk/engines/gob/inter_v1.cpp
===================================================================
--- scummvm/trunk/engines/gob/inter_v1.cpp	2009-06-06 20:58:36 UTC (rev 41304)
+++ scummvm/trunk/engines/gob/inter_v1.cpp	2009-06-06 21:37:30 UTC (rev 41305)
@@ -1910,7 +1910,7 @@
 
 	_vm->_draw->_backColor = _vm->_parse->parseValExpr();
 
-	if (!_vm->_draw->_spritesArray[(destSurf > 100) ? (destSurf - 80) : destSurf])
+	if (!_vm->_draw->_spritesArray[(destSurf >= 100) ? (destSurf - 80) : destSurf])
 		return false;
 
 	if (_vm->_draw->_spriteRight < 0) {

Modified: scummvm/trunk/engines/gob/video.h
===================================================================
--- scummvm/trunk/engines/gob/video.h	2009-06-06 20:58:36 UTC (rev 41304)
+++ scummvm/trunk/engines/gob/video.h	2009-06-06 21:37:30 UTC (rev 41305)
@@ -54,7 +54,6 @@
 	void setVidMem(byte *vidMem);
 	void resize(int16 width, int16 height);
 	void swap(SurfaceDesc &surf);
-	void swap(SurfaceDesc *surf) { assert(surf); swap(*surf); }
 
 	SurfaceDesc(int16 vidMode, int16 width, int16 height, byte *vidMem = 0);
 	~SurfaceDesc() { if (_ownVidMem) delete[] _vidMem; }


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.