[Scummvm-git-logs] scummvm master -> 8f8ed6faa9d7097802d6a18ea14af36a5d906542

[sev-]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
8f8ed6faa9 QDENGINE: DT: Do not crash on frame index overflow


Commit: 8f8ed6faa9d7097802d6a18ea14af36a5d906542
    https://github.com/scummvm/scummvm/commit/8f8ed6faa9d7097802d6a18ea14af36a5d906542
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2024-09-08T17:23:37+02:00

Commit Message:
QDENGINE: DT: Do not crash on frame index overflow

Changed paths:
    engines/qdengine/system/graphics/gr_tile_animation.cpp


diff --git a/engines/qdengine/system/graphics/gr_tile_animation.cpp b/engines/qdengine/system/graphics/gr_tile_animation.cpp
index 215964255c8..bc8fea2fc67 100644
--- a/engines/qdengine/system/graphics/gr_tile_animation.cpp
+++ b/engines/qdengine/system/graphics/gr_tile_animation.cpp
@@ -598,11 +598,16 @@ Graphics::ManagedSurface *grTileAnimation::dumpFrameTiles(int frame_index, float
 
 	Graphics::ManagedSurface *dstSurf = new Graphics::ManagedSurface(w, h, g_engine->_pixelformat);
 
-	const uint32 *index_ptr = &_frameIndex[frameStart] + frameTileSize.x * frameTileSize.y * frame_index;
+	int idx = frameStart + frameTileSize.x * frameTileSize.y * frame_index;
 
 	for (int i = 0; i < frameTileSize.y; i++) {
 		for (int j = 0; j < frameTileSize.x; j++) {
-			const byte *src = (const byte *)getTile(*index_ptr++).data();
+			if (idx >= _frameIndex.size()) {
+				warning("grTileAnimation::dumpFrameTiles(): overflow of frame index (%d > %d)", idx, _frameIndex.size());
+				break;
+			}
+
+			const byte *src = (const byte *)getTile(_frameIndex[idx++]).data();
 
 			for (int yy = 0; yy < GR_TILE_SPRITE_SIZE_Y; yy++) {
 				uint16 *dst = (uint16 *)dstSurf->getBasePtr(j * (GR_TILE_SPRITE_SIZE_X + 1), i * (GR_TILE_SPRITE_SIZE_Y + 1) + yy);