[Scummvm-git-logs] scummvm master -> 77151b611059a187cc76e798a749bf900172d8d7

[bluegr]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
77151b6110 DREAMWEB: Fix index overflow and crash in `deleteExFrame`


Commit: 77151b611059a187cc76e798a749bf900172d8d7
    https://github.com/scummvm/scummvm/commit/77151b611059a187cc76e798a749bf900172d8d7
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2024-10-30T00:35:48+02:00

Commit Message:
DREAMWEB: Fix index overflow and crash in `deleteExFrame`

Fixes bug #15420

Changed paths:
    engines/dreamweb/dreamweb.h
    engines/dreamweb/object.cpp
    engines/dreamweb/vgagrafx.cpp


diff --git a/engines/dreamweb/dreamweb.h b/engines/dreamweb/dreamweb.h
index cc60d4c36dd..325debe8e8d 100644
--- a/engines/dreamweb/dreamweb.h
+++ b/engines/dreamweb/dreamweb.h
@@ -534,7 +534,7 @@ public:
 	void obPicture();
 	void removeObFromInv();
 	void deleteExObject(uint8 index);
-	void deleteExFrame(uint8 frameNum);
+	void deleteExFrame(uint16 frameNum);
 	void deleteExText(uint8 textNum);
 	void purgeALocation(uint8 index);
 	const uint8 *getObTextStart();
diff --git a/engines/dreamweb/object.cpp b/engines/dreamweb/object.cpp
index a0221bd796f..f5e65d1e2fd 100644
--- a/engines/dreamweb/object.cpp
+++ b/engines/dreamweb/object.cpp
@@ -96,7 +96,7 @@ void DreamWebEngine::obToInv(uint8 index, uint8 flag, uint16 x, uint16 y) {
 void DreamWebEngine::obPicture() {
 	if (_objectType == kSetObjectType1)
 		return;
-	uint8 frame = 3 * _command + 1;
+	uint16 frame = 3 * _command + 1;
 	if (_objectType == kExObjectType)
 		showFrame(_exFrames, 160, 68, frame, 0x80);
 	else
@@ -424,7 +424,8 @@ void DreamWebEngine::setPickup() {
 	workToScreenM();
 }
 
-void DreamWebEngine::deleteExFrame(uint8 frameNum) {
+void DreamWebEngine::deleteExFrame(uint16 frameNum) {
+	assert(frameNum < 346); // see GraphicsFile::getFrameData
 	Frame *frame = &_exFrames._frames[frameNum];
 
 	uint16 frameSize = frame->width * frame->height;
diff --git a/engines/dreamweb/vgagrafx.cpp b/engines/dreamweb/vgagrafx.cpp
index 4735e95f06f..32b78fdb1f3 100644
--- a/engines/dreamweb/vgagrafx.cpp
+++ b/engines/dreamweb/vgagrafx.cpp
@@ -304,7 +304,7 @@ void DreamWebEngine::dumpZoom() {
 }
 
 void DreamWebEngine::crosshair() {
-	uint8 frame;
+	uint16 frame;
 	if ((_commandType != 3) && (_commandType < 10)) {
 		frame = 9;
 	} else {