[Scummvm-git-logs] scummvm master -> ad4dda6e802e5a1d36942182a78d78689b9b30d1

[dreammaster]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .

Summary:
ad4dda6e80 MADS: Fix array overrun in implode.cpp


Commit: ad4dda6e802e5a1d36942182a78d78689b9b30d1
    https://github.com/scummvm/scummvm/commit/ad4dda6e802e5a1d36942182a78d78689b9b30d1
Author: Paul Gilbert (dreammaster at scummvm.org)
Date: 2026-08-01T12:04:37+10:00

Commit Message:
MADS: Fix array overrun in implode.cpp

Assisted-by: Claude Code:claude-opus-4.8

Changed paths:
    engines/mads/core/implode.cpp


diff --git a/engines/mads/core/implode.cpp b/engines/mads/core/implode.cpp
index da529ebd3d5..31e1256db5c 100644
--- a/engines/mads/core/implode.cpp
+++ b/engines/mads/core/implode.cpp
@@ -78,8 +78,15 @@ struct ExpState {
 	word(*read_buff) (char *buf, word *size);
 	word(*write_buff)(char *buf, word *size);
 
-	/* Read buffer: rb[0]=guard, rb[1..EXP_RBLEN]=data */
-	byte   rb[EXP_RBLEN + 1];
+	/* Read buffer: rb[0]=guard, rb[1..EXP_RBLEN]=data.
+	 * One extra trailing byte (rb[EXP_RBLEN+1]) is reserved beyond the data
+	 * region: explode_RBin() reads rb[si] *before* resetting si, and si can
+	 * be EXP_RBLEN+1 (one past the last data byte) both on the very first
+	 * refill and whenever exp_get_byte()'s si > EXP_RBLEN check fires. The
+	 * original assembly's equivalent read safely spilled into the adjacent
+	 * Lempel region of the same WORK segment; here we reserve the byte
+	 * explicitly instead of relying on undefined behaviour. */
+	byte   rb[EXP_RBLEN + 2];
 	int    si;          /* current read index into rb[], range [1..EXP_RBLEN] */
 	/* si <= EXP_RBLEN  => valid byte at rb[si]  (mirrors si <= RBend) */