[Scummvm-git-logs] scummvm master -> cffd2b00f7e6980e5a74e1029328af2fadd298ee

[bluegr]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
cffd2b00f7 GRAPHICS: Fix OOB writes when drawing underlined text where the underline doesn't fit in bounds.


Commit: cffd2b00f7e6980e5a74e1029328af2fadd298ee
    https://github.com/scummvm/scummvm/commit/cffd2b00f7e6980e5a74e1029328af2fadd298ee
Author: elasota (ejlasota at gmail.com)
Date: 2023-08-16T19:12:49+03:00

Commit Message:
GRAPHICS: Fix OOB writes when drawing underlined text where the underline doesn't fit in bounds.

Changed paths:
    graphics/fonts/macfont.cpp


diff --git a/graphics/fonts/macfont.cpp b/graphics/fonts/macfont.cpp
index 483873f7931..a97fd51ba25 100644
--- a/graphics/fonts/macfont.cpp
+++ b/graphics/fonts/macfont.cpp
@@ -432,13 +432,25 @@ void MacFONTFont::drawChar(Surface *dst, uint32 chr, int x, int y, uint32 color)
 
 	// for the underLine font, we need to draw the line at the whole area, which includes the kerning space.
 	if ((_data._slant & kMacFontUnderline) && glyph->kerningOffset) {
-		for (uint16 j = 1; j <= glyph->kerningOffset; j++) {
-			if (dst->format.bytesPerPixel == 1)
-				*((byte *)dst->getBasePtr(x - j, y + _data._ascent + 2)) = color;
-			else if (dst->format.bytesPerPixel == 2)
-				*((uint16 *)dst->getBasePtr(x - j, y + _data._ascent + 2)) = color;
-			else if (dst->format.bytesPerPixel == 4)
-				*((uint32 *)dst->getBasePtr(x - j, y + _data._ascent + 2)) = color;
+		int underlineY = y + _data._ascent + 2;
+
+		if (underlineY >= 0 && underlineY < dst->h) {
+			int underlineXStart = x - glyph->kerningOffset;
+			int underlineXEnd = x - 1;
+
+			if (underlineXStart < 0)
+				underlineXStart = 0;
+			if (underlineXEnd >= dst->w)
+				underlineXEnd = dst->w - 1;
+
+			for (int ulx = underlineXStart; ulx <= underlineXEnd; ulx++) {
+				if (dst->format.bytesPerPixel == 1)
+					*((byte *)dst->getBasePtr(ulx, underlineY)) = color;
+				else if (dst->format.bytesPerPixel == 2)
+					*((uint16 *)dst->getBasePtr(ulx, underlineY)) = color;
+				else if (dst->format.bytesPerPixel == 4)
+					*((uint32 *)dst->getBasePtr(ulx, underlineY)) = color;
+			}
 		}
 	}