From 7cfd3feec64a6917c85bcc4ea00a5da47a2f1ae0 Mon Sep 17 00:00:00 2001
From: wonst719 <wonst719@gmail.com>
Date: Sun, 15 Nov 2020 17:33:49 +0900
Subject: [PATCH] SCUMM: Fix OOB access in CharsetRendererPC::drawBits1Kor()

---
 engines/scumm/charset.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/engines/scumm/charset.cpp b/engines/scumm/charset.cpp
index 05806aa481f..38ddfd12bca 100644
--- a/engines/scumm/charset.cpp
+++ b/engines/scumm/charset.cpp
@@ -785,10 +785,10 @@ void CharsetRendererPC::drawBits1Kor(Graphics::Surface &dest, int x1, int y1, co
 		dst = origDst;
 
 		for (y = 0; y < height && y + drawTop + offsetY[i] < dest.h; y++) {
-			for (x = 0; x < width && x + offsetY[i] < dest.w; x++) {
+			for (x = 0; x < width && x + x1 + offsetX[i] < dest.w; x++) {
 				if ((x % 8) == 0)
 					bits = *src++;
-				if ((bits & revBitMask(x % 8)) && y + drawTop >= 0) {
+				if ((bits & revBitMask(x % 8)) && y + drawTop + offsetY[i] >= 0 && x + x1 + offsetX[i] >= 0) {
 					if (_enableShadow) {
 						*(dst + 1) = _shadowColor;
 						*(dst + dest.pitch) = _shadowColor;