[Scummvm-git-logs] scummvm master -> 64a93af9ab10232b960ceafdda2d56334c759d03

[athrxx]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
64a93af9ab SCUMM: fix bug no. 13935


Commit: 64a93af9ab10232b960ceafdda2d56334c759d03
    https://github.com/scummvm/scummvm/commit/64a93af9ab10232b960ceafdda2d56334c759d03
Author: athrxx (athrxx at scummvm.org)
Date: 2022-11-18T01:09:43+01:00

Commit Message:
SCUMM: fix bug no. 13935

("FT: buffer-overflow during ending credits")

Changed paths:
    engines/scumm/charset.cpp


diff --git a/engines/scumm/charset.cpp b/engines/scumm/charset.cpp
index e728009454e..8eb54ed9c34 100644
--- a/engines/scumm/charset.cpp
+++ b/engines/scumm/charset.cpp
@@ -2006,7 +2006,7 @@ int CharsetRendererV7::drawCharV7(byte *buffer, Common::Rect &clipRect, int x, i
 		x -= _width;
 
 	int width = MIN(_origWidth, clipRect.right - x);
-	int height = MIN(_origHeight, clipRect.bottom - y);
+	int height = MIN(_origHeight, clipRect.bottom - (y + _offsY));
 
 	_vm->_charsetColorMap[1] = col;
 	byte *cmap = _vm->_charsetColorMap;
@@ -2020,7 +2020,7 @@ int CharsetRendererV7::drawCharV7(byte *buffer, Common::Rect &clipRect, int x, i
 	while (height--) {
 		for (int dx = x; dx < x + _origWidth; ++dx) {
 			byte color = (bits >> (8 - bpp)) & 0xFF;
-			if (color && dx >= 0 && dx < x + width && y >= 0)
+			if (color && dx >= 0 && dx < x + width && (y + _offsY) >= 0)
 				*dst = cmap[color];
 			dst++;
 			bits <<= bpp;