[Scummvm-git-logs] scummvm master -> f1d753c1c4f061c43ab97b8591d7e292f5943a94

[criezy]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
f1d753c1c4 AGS: Fix out of bound memory access with getpixel


Commit: f1d753c1c4f061c43ab97b8591d7e292f5943a94
    https://github.com/scummvm/scummvm/commit/f1d753c1c4f061c43ab97b8591d7e292f5943a94
Author: Thierry Crozat (criezy at scummvm.org)
Date: 2021-02-11T23:40:01Z

Commit Message:
AGS: Fix out of bound memory access with getpixel

The allegro implementation returns -1 when called with a pixel
that lies outside the bitmap. Doing the same in the implementation
in ScummVM fixes a crash in some games.

Changed paths:
    engines/ags/lib/allegro/gfx.cpp


diff --git a/engines/ags/lib/allegro/gfx.cpp b/engines/ags/lib/allegro/gfx.cpp
index ffa5872ec8..a1ad0e4ea5 100644
--- a/engines/ags/lib/allegro/gfx.cpp
+++ b/engines/ags/lib/allegro/gfx.cpp
@@ -450,6 +450,11 @@ void _putpixel32(BITMAP *bmp, int x, int y, int color) {
 
 int getpixel(BITMAP *bmp, int x, int y) {
 	Graphics::ManagedSurface &surf = **bmp;
+
+	// Allegro returns -1 if the pixel lies outside the bitmap
+	if (x < 0 || y < 0 || x >= surf.w || y >= surf.h)
+		return -1;
+
 	void *p = surf.getBasePtr(x, y);
 
 	switch (surf.format.bytesPerPixel) {
@@ -468,6 +473,8 @@ int getpixel(BITMAP *bmp, int x, int y) {
 
 int _getpixel(BITMAP *bmp, int x, int y) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || y < 0 || x >= surf.w || y >= surf.h)
+		return -1;
 	void *p = surf.getBasePtr(x, y);
 	return *((uint8 *)p);
 }
@@ -478,6 +485,8 @@ int _getpixel15(BITMAP *bmp, int x, int y) {
 
 int _getpixel16(BITMAP *bmp, int x, int y) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || y < 0 || x >= surf.w || y >= surf.h)
+		return -1;
 	void *p = surf.getBasePtr(x, y);
 	return *((uint16 *)p);
 }
@@ -488,6 +497,8 @@ int _getpixel24(BITMAP *bmp, int x, int y) {
 
 int _getpixel32(BITMAP *bmp, int x, int y) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || y < 0 || x >= surf.w || y >= surf.h)
+		return -1;
 	void *p = surf.getBasePtr(x, y);
 	return *((uint32 *)p);
 }