[Scummvm-git-logs] scummvm branch-2-5 -> 723ed5d1f2b699c40425453c6bd2de7852e12923

[athrxx]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
723ed5d1f2 KYRA: (LOL) - fix invalid use after free


Commit: 723ed5d1f2b699c40425453c6bd2de7852e12923
    https://github.com/scummvm/scummvm/commit/723ed5d1f2b699c40425453c6bd2de7852e12923
Author: Benoit Pierre (benoit.pierre at gmail.com)
Date: 2021-10-27T17:30:56+02:00

Commit Message:
KYRA: (LOL) - fix invalid use after free

It's possible for `snd_loadSoundFile` to be called with a negative track number (e.g. -1).

Changed paths:
    engines/kyra/sound/sound_lol.cpp


diff --git a/engines/kyra/sound/sound_lol.cpp b/engines/kyra/sound/sound_lol.cpp
index 08b4245418..661832f774 100644
--- a/engines/kyra/sound/sound_lol.cpp
+++ b/engines/kyra/sound/sound_lol.cpp
@@ -249,7 +249,7 @@ void LoLEngine::snd_loadSoundFile(int track) {
 	if (_sound->musicEnabled()) {
 		if (_flags.platform == Common::kPlatformDOS) {
 			int t = (track - 250) * 3;
-			if (_curMusicFileIndex != _musicTrackMap[t] || _curMusicFileExt != (char)_musicTrackMap[t + 1]) {
+			if (t >= 0 && (_curMusicFileIndex != _musicTrackMap[t] || _curMusicFileExt != (char)_musicTrackMap[t + 1])) {
 				snd_stopMusic();
 				_sound->loadSoundFile(Common::String::format("LORE%02d%c", _musicTrackMap[t], (char)_musicTrackMap[t + 1]));
 				_curMusicFileIndex = _musicTrackMap[t];