[Scummvm-git-logs] scummvm master -> c2783e166b08269a6357c257c7ddd3b3518371f4

[sluicebox]

This automated email contains information about 3 new commits which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
83f3c69e80 AGI: Fix OOB array access in MickeyEngine::inventory
2baf89fa82 AGI: Fix OOB array access in MickeyEngine::drawRoom
c2783e166b AGI: Fix memory leak in WinAGI parser


Commit: 83f3c69e80b7c46a6086367a7c20fa89d97c78ed
    https://github.com/scummvm/scummvm/commit/83f3c69e80b7c46a6086367a7c20fa89d97c78ed
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2023-04-13T13:15:51-07:00

Commit Message:
AGI: Fix OOB array access in MickeyEngine::inventory

Code tested for indexer -1 after accessing array

Coverity issue 1003549

Changed paths:
    engines/agi/preagi/mickey.cpp


diff --git a/engines/agi/preagi/mickey.cpp b/engines/agi/preagi/mickey.cpp
index 4f12341d209..f5a64f65a12 100644
--- a/engines/agi/preagi/mickey.cpp
+++ b/engines/agi/preagi/mickey.cpp
@@ -1380,7 +1380,7 @@ void MickeyEngine::inventory() {
 	drawStr(IDI_MSA_ROW_INV_CRYSTALS, IDI_MSA_COL_INV_ITEMS, IDA_DEFAULT, szCrystals);
 
 	for (int iItem = 0; iItem < IDI_MSA_MAX_ITEM; iItem++) {
-		if (_gameStateMickey.fItem[_gameStateMickey.iItem[iItem]] && (_gameStateMickey.iItem[iItem] != IDI_MSA_OBJECT_NONE)) {
+		if ((_gameStateMickey.iItem[iItem] != IDI_MSA_OBJECT_NONE) && _gameStateMickey.fItem[_gameStateMickey.iItem[iItem]]) {
 			drawStr(iRow++, IDI_MSA_COL_INV_ITEMS, IDA_DEFAULT, (const char *)IDS_MSA_NAME_ITEM[_gameStateMickey.iItem[iItem]]);
 		}
 	}


Commit: 2baf89fa827f37f2039415107dc3514e2fa20f8c
    https://github.com/scummvm/scummvm/commit/2baf89fa827f37f2039415107dc3514e2fa20f8c
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2023-04-13T13:15:51-07:00

Commit Message:
AGI: Fix OOB array access in MickeyEngine::drawRoom

Code tested the wrong maximum array size

Coverity issue 1004027

Changed paths:
    engines/agi/preagi/mickey.cpp


diff --git a/engines/agi/preagi/mickey.cpp b/engines/agi/preagi/mickey.cpp
index f5a64f65a12..6230ddc893e 100644
--- a/engines/agi/preagi/mickey.cpp
+++ b/engines/agi/preagi/mickey.cpp
@@ -876,12 +876,8 @@ void MickeyEngine::drawRoom() {
 	}
 
 	// Draw room objects
-	if (_gameStateMickey.iRoom >= IDI_MSA_MAX_PIC_ROOM) {
-		drawRoomAnimation();
-		return;
-	}
-
-	if (_gameStateMickey.iRmObj[_gameStateMickey.iRoom] != IDI_MSA_OBJECT_NONE) {
+	if (_gameStateMickey.iRoom < IDI_MSA_MAX_ROOM &&
+		_gameStateMickey.iRmObj[_gameStateMickey.iRoom] != IDI_MSA_OBJECT_NONE) {
 		readOfsData(IDO_MSA_ROOM_OBJECT_XY_OFFSETS,
 		            _gameStateMickey.iRmObj[_gameStateMickey.iRoom], buffer, sizeof(buffer));
 


Commit: c2783e166b08269a6357c257c7ddd3b3518371f4
    https://github.com/scummvm/scummvm/commit/c2783e166b08269a6357c257c7ddd3b3518371f4
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2023-04-13T13:15:51-07:00

Commit Message:
AGI: Fix memory leak in WinAGI parser

Coverity issue 1446670

Changed paths:
    engines/agi/wagparser.cpp
    engines/agi/wagparser.h


diff --git a/engines/agi/wagparser.cpp b/engines/agi/wagparser.cpp
index efd488a1148..2872efb3827 100644
--- a/engines/agi/wagparser.cpp
+++ b/engines/agi/wagparser.cpp
@@ -170,11 +170,11 @@ bool WagFileParser::checkWagVersion(Common::SeekableReadStream &stream) {
 	}
 }
 
-void WagFileParser::addPropFromIni(Common::INIFile *iniWagFile, Common::String section, Common::String key, Agi::WagProperty::WagPropertyCode code) {
+void WagFileParser::addPropFromIni(Common::INIFile &iniWagFile, Common::String section, Common::String key, Agi::WagProperty::WagPropertyCode code) {
 	WagProperty property;
 	property.setPropCode(code);
 	Common::String value;
-	if (iniWagFile->getKey(key, section, value)) {
+	if (iniWagFile.getKey(key, section, value)) {
 		property.setPropDataSize(value);
 		_propList.push_back(property);
 	}
@@ -211,8 +211,8 @@ bool WagFileParser::parse(const Common::FSNode &node) {
 		} else {
 			// Invalid WinAGI version string or it couldn't be read
 			// Let's try to read WAG file as newer INI format
-			Common::INIFile *iniWagFile = new Common::INIFile();
-			_parsedOk = iniWagFile->loadFromStream(*stream);
+			Common::INIFile iniWagFile;
+			_parsedOk = iniWagFile.loadFromStream(*stream);
 			if (_parsedOk) {
 				addPropFromIni(iniWagFile, "General", "Interpreter", WagProperty::PC_INTVERSION);
 				addPropFromIni(iniWagFile, "General", "GameID", WagProperty::PC_GAMEID);
diff --git a/engines/agi/wagparser.h b/engines/agi/wagparser.h
index 9627b00037a..d1e7a3f9d6b 100644
--- a/engines/agi/wagparser.h
+++ b/engines/agi/wagparser.h
@@ -232,7 +232,7 @@ public:
 	 * @param key ini key
 	 * @param code corresponding WAG code
 	*/
-	void addPropFromIni(Common::INIFile *iniWagFile, Common::String section, Common::String key, Agi::WagProperty::WagPropertyCode code);
+	void addPropFromIni(Common::INIFile &iniWagFile, Common::String section, Common::String key, Agi::WagProperty::WagPropertyCode code);
 
 	/**
 	 * Loads a *.wag file and parses it.