[Scummvm-git-logs] scummvm master -> 1b6813bf80923bd1154335de49a9db436b2b6107
neuromancer
noreply at scummvm.org
Thu Jul 30 11:51:51 UTC 2026
This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .
Summary:
1b6813bf80 SCUMM: RA: fixed Coverity issues in the shared SMUSH and INSANE code
Commit: 1b6813bf80923bd1154335de49a9db436b2b6107
https://github.com/scummvm/scummvm/commit/1b6813bf80923bd1154335de49a9db436b2b6107
Author: neuromancer (gustavo.grieco at gmail.com)
Date: 2026-07-30T13:51:34+02:00
Commit Message:
SCUMM: RA: fixed Coverity issues in the shared SMUSH and INSANE code
Changed paths:
engines/scumm/insane/insane.cpp
engines/scumm/insane/insane.h
engines/scumm/nut_renderer.cpp
engines/scumm/smush/smush_player.cpp
diff --git a/engines/scumm/insane/insane.cpp b/engines/scumm/insane/insane.cpp
index 8560e42394a..415bacacbef 100644
--- a/engines/scumm/insane/insane.cpp
+++ b/engines/scumm/insane/insane.cpp
@@ -48,6 +48,31 @@ static const int actorAnimationData[21] = {20, 21, 22, 23, 24, 25, 26, 13, 14, 1
18, 19, 6, 7, 8, 9, 10, 11, 12};
+// The Rebel Assault subclasses don't use any of the Full Throttle state, but it
+// still has to be initialized: ~Insane() releases the resource pointers below
+// unconditionally, and initvars() covers every other member.
+Insane::Insane() {
+ _vm = nullptr;
+ _player = nullptr;
+
+ initvars();
+ _speed = 0;
+
+ _smush_roadrashRip = nullptr;
+ _smush_roadrsh2Rip = nullptr;
+ _smush_roadrsh3Rip = nullptr;
+ _smush_goglpaltRip = nullptr;
+ _smush_tovista1Flu = nullptr;
+ _smush_tovista2Flu = nullptr;
+ _smush_toranchFlu = nullptr;
+ _smush_minedrivFlu = nullptr;
+ _smush_minefiteFlu = nullptr;
+ _smush_bencutNut = nullptr;
+ _smush_bensgoggNut = nullptr;
+ _smush_iconsNut = nullptr;
+ _smush_icons2Nut = nullptr;
+}
+
Insane::Insane(ScummEngine_v7 *scumm) {
_vm = scumm;
@@ -188,7 +213,8 @@ void Insane::initvars() {
_iactBits[i] = 0;
- if ((_vm->_game.features & GF_DEMO) && (_vm->_game.platform == Common::kPlatformDOS)) {
+ // _vm is null when initvars() runs for the Rebel Assault subclasses.
+ if (_vm && (_vm->_game.features & GF_DEMO) && (_vm->_game.platform == Common::kPlatformDOS)) {
init_enemyStruct(EN_ROTT1, EN_ROTT1, 0, 0, 60, 0, INV_MACE, 63, "endcrshr.san",
25, 15, 16, 26, 13, 3);
} else {
@@ -371,7 +397,7 @@ void Insane::initvars() {
init_scenePropStruct(138, 57, 0, 59, 134, 0xFF, 0xFF, 0xFF, 0, 30, 0);
_actor[0].damage = 0;
- if ((_vm->_game.features & GF_DEMO) && (_vm->_game.platform == Common::kPlatformDOS))
+ if (_vm && (_vm->_game.features & GF_DEMO) && (_vm->_game.platform == Common::kPlatformDOS))
_actor[0].maxdamage = 60;
else
_actor[0].maxdamage = 80;
diff --git a/engines/scumm/insane/insane.h b/engines/scumm/insane/insane.h
index b3611fd66b1..6ab7dcd7a06 100644
--- a/engines/scumm/insane/insane.h
+++ b/engines/scumm/insane/insane.h
@@ -51,7 +51,7 @@ namespace Scumm {
class Insane {
public:
// Used by the Rebel Assault subclasses; _player is only set later, by setSmushPlayer().
- Insane() : _vm(nullptr), _player(nullptr), _speed(0), _insaneIsRunning(false) {}
+ Insane();
Insane(ScummEngine_v7 *scumm);
virtual ~Insane();
diff --git a/engines/scumm/nut_renderer.cpp b/engines/scumm/nut_renderer.cpp
index 85cfef2cffd..f8fc711013d 100644
--- a/engines/scumm/nut_renderer.cpp
+++ b/engines/scumm/nut_renderer.cpp
@@ -269,9 +269,11 @@ void NutRenderer::loadFontFromData(const byte *data, int32 dataSize) {
if (nextOffset + 18 > length)
break;
offset = (uint32)nextOffset;
- int width = READ_LE_UINT16(dataSrc + offset + 14);
+ // Unsigned: the dimensions come straight from the file, and uint16 * uint16
+ // would otherwise be multiplied as int and sign-extended when used as a size.
+ const uint32 width = READ_LE_UINT16(dataSrc + offset + 14);
_fontHeight = READ_LE_UINT16(dataSrc + offset + 16);
- decodedLength += width * _fontHeight;
+ decodedLength += width * (uint32)_fontHeight;
}
debug(1, "NutRenderer::loadFontFromData() - numChars=%d decodedLength=%d", _numChars, decodedLength);
@@ -308,13 +310,14 @@ void NutRenderer::loadFontFromData(const byte *data, int32 dataSize) {
_chars[l].height = READ_LE_UINT16(dataSrc + offset + 16);
_chars[l].src = decodedPtr;
- decodedPtr += (_chars[l].width * _chars[l].height);
+ const uint32 charSize = (uint32)_chars[l].width * _chars[l].height;
+ decodedPtr += charSize;
if (codec == 44) {
- memset(_chars[l].src, kSmush44TransparentColor, _chars[l].width * _chars[l].height);
+ memset(_chars[l].src, kSmush44TransparentColor, charSize);
_chars[l].transparency = kSmush44TransparentColor;
} else {
- memset(_chars[l].src, kDefaultTransparentColor, _chars[l].width * _chars[l].height);
+ memset(_chars[l].src, kDefaultTransparentColor, charSize);
_chars[l].transparency = kDefaultTransparentColor;
}
diff --git a/engines/scumm/smush/smush_player.cpp b/engines/scumm/smush/smush_player.cpp
index 067fe39a575..1c6463160f4 100644
--- a/engines/scumm/smush/smush_player.cpp
+++ b/engines/scumm/smush/smush_player.cpp
@@ -663,11 +663,11 @@ void SmushPlayer::handleTextResource(uint32 subType, int32 subSize, Common::Seek
return;
}
str = _strings->get(string_id);
- if (str) {
- debugC(DEBUG_SMUSH, "SmushPlayer::handleTextResource: Found string: \"%s\"", str);
- } else {
+ if (!str) {
debugC(DEBUG_SMUSH, "SmushPlayer::handleTextResource: String ID %d not found", string_id);
+ return;
}
+ debugC(DEBUG_SMUSH, "SmushPlayer::handleTextResource: Found string: \"%s\"", str);
}
// if subtitles disabled and bit 3 is set, then do not draw
@@ -867,7 +867,9 @@ void SmushPlayer::decodeFrameObject(int codec, const uint8 *src, int left, int t
int bufSize = 242 * 384;
if (_specialBuffer == nullptr || bufSize > _specialBufferSize) {
free(_specialBuffer);
- _specialBuffer = (byte *)malloc(bufSize);
+ // Cleared: an unhandled codec leaves the buffer untouched, and it is
+ // still copied out below when _storeFrame is set.
+ _specialBuffer = (byte *)calloc(bufSize, 1);
_specialBufferSize = bufSize;
}
_dst = _specialBuffer;
More information about the Scummvm-git-logs
mailing list