From fc024141b7875bbc030d313066d01741c879e97d Mon Sep 17 00:00:00 2001 From: Thierry Crozat Date: Wed, 21 Jul 2021 22:27:20 +0100 Subject: [PATCH] CGE2: Fix heap buffer overflow This was reported by address-sanitizer. When the command is kCmdGhost, the Sprite pointer is not a valid sprite, and trying to access its content causes a buffer overflow. In normal usage it was not causing issues as while it reads some random values in memory, this was then ignore. --- engines/cge2/snail.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engines/cge2/snail.cpp b/engines/cge2/snail.cpp index ce05d763e67..eb95b9cd521 100644 --- a/engines/cge2/snail.cpp +++ b/engines/cge2/snail.cpp @@ -103,7 +103,7 @@ void CommandHandler::runCommand() { spr = (tailCmd._ref < 0) ? ((Sprite *)tailCmd._spritePtr) : _vm->locate(tailCmd._ref); Common::String sprStr; - if (spr && *spr->_file && (tailCmd._commandType != kCmdGhost)) + if (tailCmd._commandType != kCmdGhost && spr && *spr->_file) // In case of kCmdGhost _spritePtr stores a pointer to a Bitmap, not to a Sprite... sprStr = Common::String(spr->_file); else