[Scummvm-git-logs] scummvm master -> c01939731add65f864a6c830f7c2d00f768122c1

[sev-]

This automated email contains information about 3 new commits which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
42c888f8c8 SAGA2: Fix out-of-bounds read.. CID 1457984
055a316fce SAGA2: Fix allocation size. CID 1457903
c01939731a SAGA2: Fix object copying. CID 1458027


Commit: 42c888f8c81f3b83caab7305d1ba42c7ecb60c6b
    https://github.com/scummvm/scummvm/commit/42c888f8c81f3b83caab7305d1ba42c7ecb60c6b
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2021-07-06T17:49:36+02:00

Commit Message:
SAGA2: Fix out-of-bounds read.. CID 1457984

Changed paths:
    engines/saga2/magic.cpp


diff --git a/engines/saga2/magic.cpp b/engines/saga2/magic.cpp
index 6a6117e46a..9c360b5378 100644
--- a/engines/saga2/magic.cpp
+++ b/engines/saga2/magic.cpp
@@ -95,15 +95,15 @@ GameObject *GetOwner(GameObject *go) {
 // This call looks up a spells object prototype. It can accept either
 //   an object ID or a spell ID
 SkillProto *skillProtoFromID(int16 spellOrObjectID) {
-	if (spellOrObjectID > MAX_SPELLS)
-		return (SkillProto *) GameObject::protoAddress(spellOrObjectID);
+	if (spellOrObjectID >= MAX_SPELLS)
+		return (SkillProto *)GameObject::protoAddress(spellOrObjectID);
 	return spellBook[spellOrObjectID].getProto();
 }
 
 //-----------------------------------------------------------------------
 // initialization call to connect skill prototypes with their spells
 void initializeSkill(SkillProto *oNo, SpellID sNo) {
-	if (sNo > 0 && sNo <= MAX_SPELLS - 1) {
+	if (sNo > 0 && sNo < MAX_SPELLS) {
 		if (spellBook[sNo].getProto() != NULL)
 			error("Duplicate prototype for spell %d", sNo);
 		spellBook[sNo].setProto(oNo);


Commit: 055a316fceb96c3502556381227caf3f5df3c2dd
    https://github.com/scummvm/scummvm/commit/055a316fceb96c3502556381227caf3f5df3c2dd
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2021-07-06T17:49:40+02:00

Commit Message:
SAGA2: Fix allocation size. CID 1457903

Changed paths:
    engines/saga2/sprite.cpp


diff --git a/engines/saga2/sprite.cpp b/engines/saga2/sprite.cpp
index b04662b726..b0dec910d9 100644
--- a/engines/saga2/sprite.cpp
+++ b/engines/saga2/sprite.cpp
@@ -717,12 +717,12 @@ ActorAppearance *LoadActorAppearance(uint32 id, int16 banksNeeded) {
 
 		as->numPoses = poseBytes / poseSize;
 
-		as->animations = (ActorAnimation **)malloc(as->numAnimations * sizeof(ActorAnimation));
+		as->animations = (ActorAnimation **)malloc(as->numAnimations * sizeof(ActorAnimation *));
 
 		for (uint i = 0; i < as->numAnimations; i++)
 			as->animations[i] = new ActorAnimation(poseStream);
 
-		as->poses = (ActorPose **)malloc(as->numPoses * sizeof(ActorPose));
+		as->poses = (ActorPose **)malloc(as->numPoses * sizeof(ActorPose *));
 
 		for (uint i = 0; i < as->numPoses; i++)
 			as->poses[i] = new ActorPose(poseStream);


Commit: c01939731add65f864a6c830f7c2d00f768122c1
    https://github.com/scummvm/scummvm/commit/c01939731add65f864a6c830f7c2d00f768122c1
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2021-07-06T17:49:40+02:00

Commit Message:
SAGA2: Fix object copying. CID 1458027

Changed paths:
    engines/saga2/objects.cpp


diff --git a/engines/saga2/objects.cpp b/engines/saga2/objects.cpp
index c6ae0aa5d7..6a32959df3 100644
--- a/engines/saga2/objects.cpp
+++ b/engines/saga2/objects.cpp
@@ -1114,16 +1114,11 @@ ObjectID GameObject::copy(const Location &l) {
 
 ObjectID GameObject::copy(const Location &l, int16 num) {
 	GameObject      *newObj;
-//	ObjectID        id = thisID();
 
 	if (isWorld(this))
 		error("World copying not allowed.");
 
 	if (isActor(this)) {
-//      newObj = newActor();
-//      newObj->move( l );
-		// REM: Call actor copy function...
-
 		error("Actor copying not yet implemented.");
 	} else {
 		if ((newObj = newObject()) == nullptr) return Nothing;
@@ -1134,7 +1129,6 @@ ObjectID GameObject::copy(const Location &l, int16 num) {
 		newObj->_data.script      = _data.script;
 		newObj->_data.objectFlags = _data.objectFlags;
 		newObj->_data.hitPoints   = _data.hitPoints;
-		newObj->_data.massCount   = _data.massCount;
 		newObj->_data.massCount   = num;
 
 		// this did occur before any of the assignments