[Scummvm-git-logs] scummvm master -> 7fe53522fbd430adb35c48a380004a8414802dfb

[sev-]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .

Summary:
7fe53522fb DIRECTOR: Fix buffer overflow writing 8bpp bitmaps with padded pitch


Commit: 7fe53522fbd430adb35c48a380004a8414802dfb
    https://github.com/scummvm/scummvm/commit/7fe53522fbd430adb35c48a380004a8414802dfb
Author: Gianluca Boiano (morf3089 at gmail.com)
Date: 2026-07-25T13:03:55+02:00

Commit Message:
DIRECTOR: Fix buffer overflow writing 8bpp bitmaps with padded pitch

writeBITDResource() allocated w bytes per row but wrote _pitch bytes,
and the 8bpp case shifted each row's writes by y * padding, walking off
the buffer. Allocate _pitch bytes per row and write rows in place.

Fixes heap-buffer-overflow saving the initial movie in operafatal

Changed paths:
    engines/director/castmember/bitmap.cpp


diff --git a/engines/director/castmember/bitmap.cpp b/engines/director/castmember/bitmap.cpp
index 24bb74c788f..7223a6891c1 100644
--- a/engines/director/castmember/bitmap.cpp
+++ b/engines/director/castmember/bitmap.cpp
@@ -1197,23 +1197,10 @@ uint32 BitmapCastMember::writeBITDResource(Common::SeekableWriteStream *writeStr
 	}
 
 	// No compression for now
-	// pixels.size() == bytes needed
 	Graphics::Surface pixels;
 	Graphics::PixelFormat format;
-
-	if (_bitsPerPixel >> 3) {
-		format.bytesPerPixel = _bitsPerPixel >> 3;
-		pixels.create(_picture->_surface.w, _picture->_surface.h, format);
-	} else {
-		format.bytesPerPixel = 1;
-		pixels.create(_pitch, _picture->_surface.h, format);
-	}
-
-	offset = 0;
-
-	if (_bitsPerPixel == 8 && _picture->_surface.w < (int)(_pitch * _picture->_surface.h / _picture->_surface.h)) {
-		offset = (_pitch - _picture->_surface.w) % 2;
-	}
+	format.bytesPerPixel = 1;
+	pixels.create(_pitch, _picture->_surface.h, format);
 
 	debugC(5, kDebugSaving, "BitmapCastMember::writeBITDResource: Saving 'BITD' Resource: bitsPerPixel: %d, castId: %d", _bitsPerPixel, _castId);
 	for (int y = 0; y < _picture->_surface.h; y++) {
@@ -1245,7 +1232,7 @@ uint32 BitmapCastMember::writeBITDResource(Common::SeekableWriteStream *writeStr
 				break;
 
 			case 8:
-				*(ptr + (y * offset)) = *((byte *)_picture->_surface.getBasePtr(x, y));
+				*ptr = *((byte *)_picture->_surface.getBasePtr(x, y));
 				ptr++; x++;
 				break;
 
@@ -1277,6 +1264,7 @@ uint32 BitmapCastMember::writeBITDResource(Common::SeekableWriteStream *writeStr
 	if (debugChannelSet(7, kDebugSaving)) {
 		dumpFile("BitmapData", _castId, MKTAG('B', 'I', 'T', 'D'), (byte *)pixels.getPixels(), _picture->_surface.h * _pitch);
 	}
+	pixels.free();
 	return 0;
 }