[Scummvm-git-logs] scummvm branch-2-7 -> 70e2b0269648783272c36e14220ecf635634876a

[criezy]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
70e2b02696 AGS: Add more sanity checks to allegro putpixel functions


Commit: 70e2b0269648783272c36e14220ecf635634876a
    https://github.com/scummvm/scummvm/commit/70e2b0269648783272c36e14220ecf635634876a
Author: Thierry Crozat (criezy at scummvm.org)
Date: 2023-02-21T21:11:35Z

Commit Message:
AGS: Add more sanity checks to allegro putpixel functions

This fixes bug #14258: Crash and text glitches for Dreams in the Witch House

Changed paths:
    engines/ags/lib/allegro/gfx.cpp


diff --git a/engines/ags/lib/allegro/gfx.cpp b/engines/ags/lib/allegro/gfx.cpp
index 3a4aa08e59e..9ea88d6ec2a 100644
--- a/engines/ags/lib/allegro/gfx.cpp
+++ b/engines/ags/lib/allegro/gfx.cpp
@@ -234,7 +234,7 @@ void memory_putpixel(BITMAP *bmp, int x, int y, int color) {
 
 void putpixel(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
-	if (x >= surf.w || y >= surf.h)
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
 		return;
 	void *p = surf.getBasePtr(x, y);
 
@@ -255,6 +255,8 @@ void putpixel(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint8 *)p) = color;
 }
@@ -265,6 +267,8 @@ void _putpixel15(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel16(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint16 *)p) = color;
 }
@@ -275,6 +279,8 @@ void _putpixel24(BITMAP *bmp, int x, int y, int color) {
 
 void _putpixel32(BITMAP *bmp, int x, int y, int color) {
 	Graphics::ManagedSurface &surf = **bmp;
+	if (x < 0 || x >= surf.w || y < 0 || y >= surf.h)
+		return;
 	void *p = surf.getBasePtr(x, y);
 	*((uint32 *)p) = color;
 }