[Scummvm-tracker] [ScummVM :: Bugs] #16560: SCUMM: PUTTSFUNSHOP: Crash in image decoding

[ScummVM :: Bugs]

#16560: SCUMM: PUTTSFUNSHOP: Crash in image decoding
-------------------+-----------------------
Reporter:  sev-    |      Owner:  (none)
    Type:  defect  |     Status:  new
Priority:  normal  |  Component:  --Unset--
 Version:          |   Keywords:
    Game:          |
-------------------+-----------------------
 The game crashes during WizImage preparation on an attempt to print.

 Steps to reproduce:
 1. Select the top left project with a birthday cake
 2. Select the top right paper format, unfolded paper
 3. Select the top paper format, rectangle
 4. Click on the Print button in the bottom left.
 5. Click OK

 Game crashes.

 Crash is in memory access by address 0x04 (obvioulsy nullptr is involved):

 {{{
 * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS
 (code=1, address=0xd4)
   * frame #0: 0x0000000100934c30
 scummvm`Scumm::trleFLIPArbitraryDstStepDecompressLine(wiz=0x00006320000d8800,
 destPtr=0x00000000000000d4,
 dataStream="\U0000000f\xe2\U0000000f\U00000004", skipAmount=42,
 decompAmount=57, userParam=0x0000000000000000, destStepValue=1224,
 conversionTable=0x0000000000000000) at trle_comp.cpp:1018:2
     frame #1: 0x000000010092dce4
 scummvm`Scumm::Wiz::trleFLIP90DegreeRotateCore(this=0x00006320000d8800,
 dstBitmap=0x000000016fdf2480, x=100, y=-42, imagePtr=0x000000016fdf2460,
 optionalSrcRect=0x0000000000000000, optionalClipRect=0x0000000000000000,
 hFlip=false, vFlip=false, userParam=0x0000000000000000,
 conversionTable=0x0000000000000000,
 functionPtr=(scummvm`Scumm::trleFLIPArbitraryDstStepDecompressLine(Scumm::Wiz*,
 unsigned short*, unsigned char const*, int, int, void const*, int,
 unsigned short const*) at trle_comp.cpp:1009)) at trle_comp.cpp:1332:4
     frame #2: 0x00000001009325c0
 scummvm`Scumm::Wiz::trleFLIPRotate90DecompressImage(this=0x00006320000d8800,
 bufferPtr=0x0000000000000000, compData="\U00000004", bufferWidth=1224,
 bufferHeight=1600, x=100, y=-42, width=121, height=113,
 clipRectPtr=0x0000000000000000, wizFlags=0, extraTable=0x0000000000000000,
 conversionTable=0x0000000000000000, optionalICmdPtr=0x0000000000000000) at
 trle_comp.cpp:1488:3
     frame #3: 0x00000001009ff3e4
 scummvm`Scumm::Wiz::handleRotate90SpecialCase(this=0x00006320000d8800,
 image=508, state=1, x=100, y=-42, shadow=0, angle=90, scale=256,
 clipRect=0x0000000000000000, flags=0,
 optionalBitmapOverride=0x000000016fdf3080,
 optionalColorConversionTable=0x0000000000000000) at wiz_he.cpp:1962:3
     frame #4: 0x00000001009fc484
 scummvm`Scumm::Wiz::dwHandleComplexImageDraw(this=0x00006320000d8800,
 image=508, state=1, x=100, y=-42, shadow=0, angle=90, scale=256,
 clipRect=0x0000000000000000, flags=0,
 optionalBitmapOverride=0x000000016fdf3080,
 optionalColorConversionTable=0x0000000000000000) at wiz_he.cpp:1820:5
     frame #5: 0x00000001009fa810
 scummvm`Scumm::Wiz::processWizImageDrawCmd(this=0x00006320000d8800,
 params=0x0000000121916d18) at wiz_he.cpp:1371:5
     frame #6: 0x0000000100a07bfc
 scummvm`Scumm::Wiz::processWizImageCmd(this=0x00006320000d8800,
 params=0x0000000121916d18) at wiz_he.cpp:2679:3
     frame #7: 0x000000010098b2c0
 scummvm`Scumm::ScummEngine_v90he::o90_wizImageOps(this=0x00000001218e4800)
 at script_v90he.cpp:327:10
 }}}
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/16560>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM