[Scummvm-git-logs] scummvm master -> 8feeded6ae807c3a998375d701ca5bd225a6a68d

[athrxx]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
8feeded6ae AGOS: (WW) - prevent invalid memory access


Commit: 8feeded6ae807c3a998375d701ca5bd225a6a68d
    https://github.com/scummvm/scummvm/commit/8feeded6ae807c3a998375d701ca5bd225a6a68d
Author: athrxx (athrxx at scummvm.org)
Date: 2024-04-06T22:39:48+02:00

Commit Message:
AGOS: (WW) - prevent invalid memory access

It can be reproduced by clicking on the crystal ball icon.
>From looking at disasm I think it happens in the original
in the same way. But this is a static memory area, so it
will always corrupt the same variable in the original
(_fcsData1[0]) which seems to cause no harm here.

Changed paths:
    engines/agos/string.cpp


diff --git a/engines/agos/string.cpp b/engines/agos/string.cpp
index be5fad13094..3d1c73b1f8f 100644
--- a/engines/agos/string.cpp
+++ b/engines/agos/string.cpp
@@ -1031,16 +1031,19 @@ uint16 AGOSEngine_Waxworks::checkFit(char *ptr, int width, int lines) {
 
 void AGOSEngine_Waxworks::boxTextMessage(const char *x) {
 	Common::sprintf_s(_boxBufferPtr, sizeof(_boxBuffer) - (_boxBufferPtr - _boxBuffer), "%s\n", x);
-	_lineCounts[_boxLineCount] += strlen(x);
+	if (_boxLineCount < ARRAYSIZE(_lineCounts))
+		_lineCounts[_boxLineCount] += strlen(x);
 	_boxBufferPtr += strlen(x) + 1;
 	_boxLineCount++;
-	_linePtrs[_boxLineCount] = _boxBufferPtr;
+	if (_boxLineCount < ARRAYSIZE(_linePtrs))
+		_linePtrs[_boxLineCount] = _boxBufferPtr;
 	_boxCR = 1;
 }
 
 void AGOSEngine_Waxworks::boxTextMsg(const char *x) {
 	Common::sprintf_s(_boxBufferPtr, sizeof(_boxBuffer) - (_boxBufferPtr - _boxBuffer), "%s", x);
-	_lineCounts[_boxLineCount] += strlen(x);
+	if (_boxLineCount < ARRAYSIZE(_lineCounts))
+		_lineCounts[_boxLineCount] += strlen(x);
 	_boxBufferPtr += strlen(x);
 	_boxCR = 0;
 }