[Scummvm-git-logs] scummvm master -> 27eb8d4454d7e3ff2cbb572a0896a5c50b1eb048

[dreammaster]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
27eb8d4454 MM: MM1: Fix memory corruption in title screen


Commit: 27eb8d4454d7e3ff2cbb572a0896a5c50b1eb048
    https://github.com/scummvm/scummvm/commit/27eb8d4454d7e3ff2cbb572a0896a5c50b1eb048
Author: Paul Gilbert (dreammaster at scummvm.org)
Date: 2023-05-30T19:17:02-07:00

Commit Message:
MM: MM1: Fix memory corruption in title screen

Changed paths:
    engines/mm/mm1/views_enh/main_menu.cpp


diff --git a/engines/mm/mm1/views_enh/main_menu.cpp b/engines/mm/mm1/views_enh/main_menu.cpp
index 37937711982..efd179250f2 100644
--- a/engines/mm/mm1/views_enh/main_menu.cpp
+++ b/engines/mm/mm1/views_enh/main_menu.cpp
@@ -45,7 +45,7 @@ bool MainMenu::msgUnfocus(const UnfocusMessage &msg) {
 }
 
 void MainMenu::loadCircles() {
-	const Common::Rect r(0, 0, CIRCLE_RADIUS * 2, CIRCLE_RADIUS * 2);
+	const Common::Rect r(0, 0, (CIRCLE_RADIUS + 1) * 2, (CIRCLE_RADIUS + 1) * 2);
 	Gfx::ScreenDecoder decoder;
 	decoder._indexes[0] = 0;
 	decoder._indexes[1] = 2;
@@ -57,7 +57,7 @@ void MainMenu::loadCircles() {
 			const Graphics::Surface *src = decoder.getSurface();
 			Graphics::ManagedSurface *dest = &_circles[i];
 
-			dest->create(CIRCLE_RADIUS * 2, CIRCLE_RADIUS * 2);
+			dest->create((CIRCLE_RADIUS + 1) * 2, (CIRCLE_RADIUS + 1) * 2);
 			dest->fillRect(r, 255);
 			dest->setTransparentColor(255);
 			copyCircle(src, dest);
@@ -83,7 +83,7 @@ void MainMenu::copyCircle(const Graphics::Surface *src,
 			y--;
 			p += 2 * (x - y) + 1;
 		}
-		drawCircleLine(src, dest, x, y);
+		drawCircleLine(src, dest, x + 1, y + 1);
 	}
 }
 
@@ -95,6 +95,9 @@ void MainMenu::drawCircleLine(const Graphics::Surface *src,
 	src1 = (const byte *)src->getBasePtr(CIRCLE_X + CIRCLE_RADIUS - x, CIRCLE_Y + CIRCLE_RADIUS + y);
 	src2 = (const byte *)src->getBasePtr(CIRCLE_X + CIRCLE_RADIUS + x, CIRCLE_Y + CIRCLE_RADIUS + y);
 	dest1 = (byte *)dest->getBasePtr(CIRCLE_RADIUS - x, CIRCLE_RADIUS + y);
+
+const byte *dest2 = dest1 + (src2 - src1);
+assert(dest2 < (const byte *)dest->getBasePtr(0, dest->h));
 	Common::copy(src1, src2, dest1);
 
 	src1 = (const byte *)src->getBasePtr(CIRCLE_X + CIRCLE_RADIUS - x, CIRCLE_Y + CIRCLE_RADIUS - y);