[Scummvm-git-logs] scummvm master -> 1ff3f1931c4e211826c24c06df0b90120dff2f4c
neuromancer
noreply at scummvm.org
Fri Jul 10 06:19:21 UTC 2026
This automated email contains information about 2 new commits which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .
Summary:
825db469ca COLONY: small fixes from coverity, mostly defensive code
1ff3f1931c EEM: small fixes from coverity, mostly defensive code
Commit: 825db469ca889a111eb1ed7add41a93747bc8465
https://github.com/scummvm/scummvm/commit/825db469ca889a111eb1ed7add41a93747bc8465
Author: neuromancer (gustavo.grieco at gmail.com)
Date: 2026-07-10T08:18:29+02:00
Commit Message:
COLONY: small fixes from coverity, mostly defensive code
Changed paths:
engines/colony/battle.cpp
engines/colony/map.cpp
engines/colony/movement.cpp
diff --git a/engines/colony/battle.cpp b/engines/colony/battle.cpp
index cc870b5d272..95c33f1f27a 100644
--- a/engines/colony/battle.cpp
+++ b/engines/colony/battle.cpp
@@ -544,7 +544,7 @@ void ColonyEngine::battleBackdrop() {
int blue = (i * 16);
if (blue > 255)
blue = 255;
- uint32 color = (0xFF << 24) | (0 << 16) | (0 << 8) | blue;
+ uint32 color = (0xFFu << 24) | (0 << 16) | (0 << 8) | blue;
Common::Rect band(_screenR.left, bandTop, _screenR.right, bandBottom);
_gfx->fillRect(band, color);
}
diff --git a/engines/colony/map.cpp b/engines/colony/map.cpp
index e488ed58ac5..3de42026f6d 100644
--- a/engines/colony/map.cpp
+++ b/engines/colony/map.cpp
@@ -84,6 +84,13 @@ void resetObjectLayout(Common::Array<Thing> &objects) {
}
void ColonyEngine::loadMap(int mnum) {
+ // _levelData has room for 8 levels; reject anything else before
+ // initRobots() indexes _levelData[mnum - 1] (CID 1653437)
+ if (mnum < 1 || mnum > 8) {
+ warning("loadMap: invalid level %d", mnum);
+ return;
+ }
+
saveLevelState();
Common::Path mapPath(Common::String::format("MAP.%d", mnum));
diff --git a/engines/colony/movement.cpp b/engines/colony/movement.cpp
index 85179c9cdf8..a632df766db 100644
--- a/engines/colony/movement.cpp
+++ b/engines/colony/movement.cpp
@@ -545,6 +545,10 @@ int ColonyEngine::checkwall(int xnew, int ynew, Locate *pobject) {
const int xind2 = xnew >> 8;
const int yind2 = ynew >> 8;
+ // Outside the 32x32 map: treat as a solid wall (CID 1653420, 1653428)
+ if (xind2 < 0 || xind2 > 31 || yind2 < 0 || yind2 > 31)
+ return -1;
+
if (xind2 == pobject->xindex) {
if (yind2 == pobject->yindex) {
if (pobject == &_me) {
Commit: 1ff3f1931c4e211826c24c06df0b90120dff2f4c
https://github.com/scummvm/scummvm/commit/1ff3f1931c4e211826c24c06df0b90120dff2f4c
Author: neuromancer (gustavo.grieco at gmail.com)
Date: 2026-07-10T08:18:29+02:00
Commit Message:
EEM: small fixes from coverity, mostly defensive code
Changed paths:
engines/eem/animation.cpp
engines/eem/mystery.cpp
engines/eem/site.cpp
engines/eem/ui.cpp
diff --git a/engines/eem/animation.cpp b/engines/eem/animation.cpp
index bf534e23d5f..eb400827f2a 100644
--- a/engines/eem/animation.cpp
+++ b/engines/eem/animation.cpp
@@ -43,6 +43,8 @@ void decodeAnmFrameRLE(const byte *src, uint srcSize, byte *dst, uint dstSize) {
if ((n & 0x8000) == 0) {
// Skip n bytes — preserves previous-frame pixels.
+ if (n >= (uint)(dstEnd - dst))
+ break;
dst += n;
} else if ((n & 0x4000) == 0) {
// Long literal copy: (n & 0x7FFF) bytes from src to dst.
@@ -74,7 +76,10 @@ void decodeAnmFrameRLE(const byte *src, uint srcSize, byte *dst, uint dstSize) {
*dst++ = *src++;
} else {
// Short skip: (op & 0x7F) bytes — preserves previous-frame pixels.
- dst += op & 0x7F;
+ const uint skip = op & 0x7F;
+ if (skip >= (uint)(dstEnd - dst))
+ break;
+ dst += skip;
}
}
}
diff --git a/engines/eem/mystery.cpp b/engines/eem/mystery.cpp
index f385635d29d..a2cc7a3a996 100644
--- a/engines/eem/mystery.cpp
+++ b/engines/eem/mystery.cpp
@@ -330,7 +330,7 @@ bool Mystery::load(uint num, Common::RandomSource *rng, bool macintosh) {
f.close();
}
- _data = staging;
+ _data = Common::move(staging);
_number = num;
_isFloppy = false;
_isMacintosh = false;
diff --git a/engines/eem/site.cpp b/engines/eem/site.cpp
index f5db58d401a..8bf6a1aa982 100644
--- a/engines/eem/site.cpp
+++ b/engines/eem/site.cpp
@@ -1463,12 +1463,12 @@ void SiteScreen::renderStaticDrops(uint siteNum) {
}
void SiteScreen::renderFloppyDrops(uint siteNum) {
- if (!_mystery)
+ if (!_mystery || !_vm)
return;
const byte *site = _mystery->siteData(siteNum);
if (!site)
return;
- const bool mac = _vm && _vm->isMacintosh();
+ const bool mac = _vm->isMacintosh();
const uint16 dropsOff = READ_LE_UINT16(site);
const byte *drops = _mystery->blobAt(dropsOff);
if (!drops)
@@ -1502,13 +1502,13 @@ void SiteScreen::renderFloppyDrops(uint siteNum) {
}
void SiteScreen::renderAnimatedDrops(uint siteNum, uint32 tickMs) {
- if (!_mystery)
+ if (!_mystery || !_vm)
return;
- if (_vm && _vm->isMacintosh())
+ if (_vm->isMacintosh())
return;
- if (_vm && _vm->isFloppy()) {
+ if (_vm->isFloppy()) {
const byte *siteAnim = _mystery->floppySiteAnimData(siteNum);
if (!siteAnim)
return;
@@ -1850,6 +1850,8 @@ byte currentWhitePaletteIndex(byte fallback) {
void SiteScreen::renderHotspots(uint siteNum) {
if (ConfMan.getBool("hide_highlight_boxes"))
return;
+ if (!_vm || !_mystery)
+ return;
const byte *spots = _mystery->hotspots(siteNum);
const uint16 count = _mystery->hotspotCount(siteNum);
@@ -1871,10 +1873,9 @@ void SiteScreen::renderHotspots(uint siteNum) {
// don't inherit the first site's seen state after travel/reload).
// Floppy = 8-byte plain rect only; searched state is derived by
// walking the dialog record list, like `_HotspotSearched_Floppy`.
- const bool compact = _vm &&
- (_vm->isFloppy() || (_mystery && _mystery->usesCompactMacData()));
- const bool floppy = _vm && _vm->isFloppy();
- const bool mac = _vm && _vm->isMacintosh();
+ const bool compact = _vm->isFloppy() || _mystery->usesCompactMacData();
+ const bool floppy = _vm->isFloppy();
+ const bool mac = _vm->isMacintosh();
const uint stride = compact ? 8 : 14;
// The floppy SITEPALS has at least one searchable site where 0xFF is
// yellow. The CD corrected that palette data; for floppy, draw with an
@@ -1931,15 +1932,16 @@ void SiteScreen::renderHotspots(uint siteNum) {
}
int SiteScreen::hotspotAtPoint(uint siteNum, int x, int y) const {
+ if (!_vm || !_mystery)
+ return -1;
const byte *spots = _mystery->hotspots(siteNum);
const uint16 count = _mystery->hotspotCount(siteNum);
if (!spots)
return -1;
- const bool compact = _vm &&
- (_vm->isFloppy() || (_mystery && _mystery->usesCompactMacData()));
+ const bool compact = _vm->isFloppy() || _mystery->usesCompactMacData();
const uint stride = compact ? 8 : 14;
- const bool mac = _vm && _vm->isMacintosh();
+ const bool mac = _vm->isMacintosh();
for (uint i = 0; i < count; i++) {
const byte *r = spots + i * stride;
Common::Rect rect;
@@ -1952,8 +1954,9 @@ int SiteScreen::hotspotAtPoint(uint siteNum, int x, int y) const {
// CD hotspot row +0xc..d: cursor id for `_SwitchMouse` (EEM1 ships 0; EEM2
// uses 2/3 examine, etc.). Floppy rows are 8-byte rects with no cursor field.
int SiteScreen::hotspotCursorId(uint siteNum, int idx) const {
- if (idx < 0 || (_vm && (_vm->isFloppy() ||
- (_mystery && _mystery->usesCompactMacData()))))
+ if (idx < 0 || !_vm || !_mystery)
+ return 0;
+ if (_vm->isFloppy() || _mystery->usesCompactMacData())
return 0;
const byte *spots = _mystery->hotspots(siteNum);
if (!spots || (uint)idx >= _mystery->hotspotCount(siteNum))
diff --git a/engines/eem/ui.cpp b/engines/eem/ui.cpp
index 37adc6b7d7a..db91e860382 100644
--- a/engines/eem/ui.cpp
+++ b/engines/eem/ui.cpp
@@ -950,10 +950,10 @@ bool animateCaseSelectionReveal(EEMEngine *vm, const Picture *caseBg,
bool haveRevealPic, const Animation *kdAnim,
bool haveKdAnim, int kdAnimX, int kdAnimY,
uint book) {
- if (!haveRevealPic || !revealPic || revealPic->surface.empty())
+ if (!vm || !haveRevealPic || !revealPic || revealPic->surface.empty())
return false;
- const int steps = vm && vm->isFloppy()
+ const int steps = vm->isFloppy()
? revealPic->surface.w : revealPic->surface.h;
for (int i = 1; i <= steps; i++) {
if (pumpQuitEvents(vm))
@@ -963,7 +963,7 @@ bool animateCaseSelectionReveal(EEMEngine *vm, const Picture *caseBg,
scratch.clear();
if (haveCaseBg && caseBg)
scratch.simpleBlitFrom(caseBg->surface);
- if (vm && vm->isFloppy()) {
+ if (vm->isFloppy()) {
blitMaskedPicRightReveal(scratch, *revealPic,
vm->scaleX(kCaseSelectionRevealX),
vm->scaleY(kCaseSelectionRevealY), i);
More information about the Scummvm-git-logs
mailing list