[ scummvm-Bugs-1327972 ] BS1: crash in load game dialog

[SourceForge.net]

Bugs item #1327972, was opened at 2005-10-16 16:50
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=418820&aid=1327972&group_id=37116

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: GUI
Group: Broken Sword 1
Status: Open
Resolution: None
Priority: 5
Submitted By: Willem Jan Palenstijn (wjpalenstijn)
Assigned to: Nobody/Anonymous (nobody)
Summary: BS1: crash in load game dialog

Initial Comment:
If you have less than 8 savegames and press the page
down button in the restore game dialog, the game
crashes instantly.

Cause:
saveNameScroll sets maxScroll to the number of
savegames, e.g., 1.,
and this causes _saveScrollPos to be set to -7, which
is translated to 249 because it's a uint8. Trying to
print the savegame name then corrupts overflows the 40
byte string buffer, corrupts the stack, and crashes.

Possible fixes:
Add "if (maxScroll < 8) maxScroll = 8;" after setting
maxScroll in saveNameScroll().

Alternatively, don't try to scroll at all if _saveFiles
< 8.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=418820&aid=1327972&group_id=37116