[Scummvm-git-logs] scummvm master -> ec8d8beda7e25241890956f506901c4414c6cea8

[criezy]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
ec8d8beda7 AGS: Add more sanity checks to allegro putpixel functions


Commit: ec8d8beda7e25241890956f506901c4414c6cea8
    https://github.com/scummvm/scummvm/commit/ec8d8beda7e25241890956f506901c4414c6cea8
Author: Thierry Crozat (criezy at scummvm.org)
Date: 2023-02-21T21:10:48Z

Commit Message:
AGS: Add more sanity checks to allegro putpixel functions

This fixes bug #14258: Crash and text glitches for Dreams in the Witch House

Changed paths:
    engines/ags/lib/allegro/gfx.cpp


diff --git a/engines/ags/lib/allegro/gfx.cpp b/engines/ags/lib/allegro/gfx.cpp
index 3a4aa08e59e..9ea88d6ec2a 100644
--- a/engines/ags/lib/allegro/gfx.cpp
+++ b/engines/ags/lib/allegro/gfx.cpp
@@ -234,7 +234,7 @@ void memory_putpixel(BITMAP *bmp, int x, int y, int color) {
 
 void putpixel(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
-	if (x >= surf.w || y >= surf.h)
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
 		return;
 	void *p = surf.getBasePtr(x, y);
 
@@ -255,6 +255,8 @@ void putpixel(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint8 *)p) = color;
 }
@@ -265,6 +267,8 @@ void _putpixel15(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel16(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint16 *)p) = color;
 }
@@ -275,6 +279,8 @@ void _putpixel24(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel32(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint32 *)p) = color;
 }