[Scummvm-cvs-logs] scummvm master -> 0b4baa6873ae9a8249b8ce63a19fe0ed0d99f7b0

[Strangerke]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
0b4baa6873 AVALANCHE: Fix a couple of (theoretical) out of bounds accesses (CID 1109650)


Commit: 0b4baa6873ae9a8249b8ce63a19fe0ed0d99f7b0
    https://github.com/scummvm/scummvm/commit/0b4baa6873ae9a8249b8ce63a19fe0ed0d99f7b0
Author: Strangerke (strangerke at scummvm.org)
Date: 2013-10-23T22:56:32-07:00

Commit Message:
AVALANCHE: Fix a couple of (theoretical) out of bounds accesses (CID 1109650)

Changed paths:
    engines/avalanche/avalot.cpp
    engines/avalanche/parser.cpp
    engines/avalanche/parser.h



diff --git a/engines/avalanche/avalot.cpp b/engines/avalanche/avalot.cpp
index a710884..072ad00 100644
--- a/engines/avalanche/avalot.cpp
+++ b/engines/avalanche/avalot.cpp
@@ -1229,7 +1229,7 @@ void AvalancheEngine::checkClick() {
 					_parser->_thing += 49;
 					_parser->_person = kPeoplePardon;
 				} else {
-					_parser->_person = (People) _thinks;
+					_parser->_person = (People)_thinks;
 					_parser->_thing = _parser->kPardon;
 				}
 				callVerb(kVerbCodeExam);
diff --git a/engines/avalanche/parser.cpp b/engines/avalanche/parser.cpp
index 4cc184b..297f27f 100644
--- a/engines/avalanche/parser.cpp
+++ b/engines/avalanche/parser.cpp
@@ -1015,10 +1015,13 @@ bool Parser::isHolding() {
 
 	if (_thing > 100)
 		_vm->_dialogs->displayText("Be reasonable!");
-	else if (!_vm->_objects[_thing - 1])
-		// Verbs that need "_thing" to be in the inventory.
-		_vm->_dialogs->displayText("You're not holding it, Avvy.");
-	else
+	else if (_thing <= kObjectNum) {
+		if (!_vm->_objects[_thing - 1])
+			// Verbs that need "_thing" to be in the inventory.
+			_vm->_dialogs->displayText("You're not holding it, Avvy.");
+		else
+			holdingResult = true;
+	} else
 		holdingResult = true;
 
 	return holdingResult;
@@ -1053,8 +1056,10 @@ void Parser::examine() {
 				examineObject();
 			else if ((50 <= _thing) && (_thing <= 100)) {
 				// Also _thing
+				int id = _thing - 50;
+				assert(id < 31);
 				openBox(true);
-				_vm->_dialogs->displayText(*_vm->_also[_thing - 50][1]);
+				_vm->_dialogs->displayText(*_vm->_also[id][1]);
 				openBox(false);
 			}
 		}
diff --git a/engines/avalanche/parser.h b/engines/avalanche/parser.h
index 261e5ec..bdb5ab9 100644
--- a/engines/avalanche/parser.h
+++ b/engines/avalanche/parser.h
@@ -66,7 +66,7 @@ public:
 	Common::String _inputText; // Original name: current
 	Common::String _inputTextBackup;
 	byte _inputTextPos; // Original name: curpos
-	bool _quote; // 66 or 99 next?
+	bool _quote;
 	bool _cursorState;
 	bool _weirdWord;