[Scummvm-git-logs] scummvm master -> 3911b564448417cf52e7153339f3cb1714d0917d

[digitall]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
3911b56444 GRAPHICS: MACGUI: Fix Possible Out of Bounds Read with Trailing Ampersand


Commit: 3911b564448417cf52e7153339f3cb1714d0917d
    https://github.com/scummvm/scummvm/commit/3911b564448417cf52e7153339f3cb1714d0917d
Author: D G Turner (digitall at scummvm.org)
Date: 2019-10-05T00:38:40+01:00

Commit Message:
GRAPHICS: MACGUI: Fix Possible Out of Bounds Read with Trailing Ampersand

Since the ampersand is used as an escape character, it is repeated when
it actually appears in the string. Unfortunately, this requires a one
character lookahead which could result in reading beyond the string if
this ampersand is the last character (which would be malformed, but
possible). To avoid an out of bounds read, this is now qualified by
the string length. Trailing ampersands will now be ignored without issue.

Changed paths:
    graphics/macgui/macmenu.cpp


diff --git a/graphics/macgui/macmenu.cpp b/graphics/macgui/macmenu.cpp
index 2f95d01..d8fc4a6 100644
--- a/graphics/macgui/macmenu.cpp
+++ b/graphics/macgui/macmenu.cpp
@@ -368,11 +368,13 @@ int MacMenu::addMenuItem(MacMenuSubMenu *submenu, const Common::U32String &text,
 
 	for (uint i = 0; i < text.size(); i++)
 		if (text[i] == amp[0]) {
-			if ((text[i + 1] & 0xff) != '&') {
-				shortcut = text[i + 1] & 0xff;
-				shortcutPos = i;
-			} else {
-				res += text[i];
+			if (i < text.size() - 1) {
+				if ((text[i + 1] & 0xff) != '&') {
+					shortcut = text[i + 1] & 0xff;
+					shortcutPos = i;
+				} else {
+					res += text[i];
+				}
 			}
 		} else {
 			res += text[i];