[Scummvm-git-logs] scummvm master -> 7c95deb5b6f1311fb34c095fc4df3c979a893f50

[dreammaster]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
7c95deb5b6 XEEN: Check bounds of stat values array, bug #10971


Commit: 7c95deb5b6f1311fb34c095fc4df3c979a893f50
    https://github.com/scummvm/scummvm/commit/7c95deb5b6f1311fb34c095fc4df3c979a893f50
Author: Peter Helbing (peter at abulafia.org)
Date: 2019-06-09T14:17:23-07:00

Commit Message:
XEEN: Check bounds of stat values array, bug #10971

Changed paths:
    engines/xeen/character.cpp
    engines/xeen/dialogs/dialogs_char_info.cpp


diff --git a/engines/xeen/character.cpp b/engines/xeen/character.cpp
index afc013b..47ef0b8 100644
--- a/engines/xeen/character.cpp
+++ b/engines/xeen/character.cpp
@@ -418,8 +418,9 @@ int Character::statColor(int amount, int threshold) {
 
 int Character::statBonus(uint statValue) const {
 	int idx;
-	for (idx = 0; Res.STAT_VALUES[idx] <= (int)statValue; ++idx)
-		;
+	for (idx = 0; idx < ARRAYSIZE(Res.STAT_VALUES) - 1; ++idx)
+		if (Res.STAT_VALUES[idx] > (int)statValue)
+			break;
 
 	return Res.STAT_BONUSES[idx];
 }
diff --git a/engines/xeen/dialogs/dialogs_char_info.cpp b/engines/xeen/dialogs/dialogs_char_info.cpp
index aec8be5..3923caf 100644
--- a/engines/xeen/dialogs/dialogs_char_info.cpp
+++ b/engines/xeen/dialogs/dialogs_char_info.cpp
@@ -359,9 +359,9 @@ bool CharacterInfo::expandStat(int attrib, const Character &c) {
 		// Basic attributes
 		stat1 = c.getStat((Attribute)attrib, false);
 		stat2 = c.getStat((Attribute)attrib, true);
-		idx = 0;
-		while (Res.STAT_VALUES[idx] <= (int)stat1)
-			++idx;
+		for (idx = 0; idx < ARRAYSIZE(Res.STAT_VALUES) - 1; ++idx)
+			if (Res.STAT_VALUES[idx] > (int)stat1)
+				break;
 
 		msg = Common::String::format(Res.CURRENT_MAXIMUM_RATING_TEXT, Res.STAT_NAMES[attrib],
 			stat1, stat2, Res.RATING_TEXT[idx]);