[Scummvm-git-logs] scummvm master -> efae21557a9af6470201d7bf1272fb9ac68b22bd

[bluegr]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .

Summary:
efae21557a NANCY: Fix buffer overread in HamRadioPuzzle


Commit: efae21557a9af6470201d7bf1272fb9ac68b22bd
    https://github.com/scummvm/scummvm/commit/efae21557a9af6470201d7bf1272fb9ac68b22bd
Author: tunnelsociety (tunnelsociety at mm.st)
Date: 2026-07-09T01:58:25+03:00

Commit Message:
NANCY: Fix buffer overread in HamRadioPuzzle

The buffer could be entirely filled with characters, with no NUL terminator

Changed paths:
    engines/nancy/action/puzzle/hamradiopuzzle.cpp


diff --git a/engines/nancy/action/puzzle/hamradiopuzzle.cpp b/engines/nancy/action/puzzle/hamradiopuzzle.cpp
index 42343fed118..41db1edcc2c 100644
--- a/engines/nancy/action/puzzle/hamradiopuzzle.cpp
+++ b/engines/nancy/action/puzzle/hamradiopuzzle.cpp
@@ -160,9 +160,13 @@ void HamRadioPuzzle::setFrequency(const Common::Array<uint16> &freq) {
 }
 
 void HamRadioPuzzle::CCSound::readData(Common::SeekableReadStream &stream) {
-	char buf[100];
-	stream.read(buf, 100);
-	assembleTextLine(buf, text, 100);
+	// One line, "Voice: Mensaje recibido.<n>..." fills all bytes, no NUL!
+	// Guarantee NUL-terminated buf, even up to `size` chars.
+	const uint size = 100;
+	char buf[size + 1];
+	stream.read(buf, size);
+	buf[size] = 0;
+	assembleTextLine(buf, text, size);
 	sound.readNormal(stream);
 }