kArrayCopy would perform an unnecessary memory copy of the source
array, the treatment of the count value as unsigned was clearly
not correct since it was being sign-extended and checked against
-1.
This fixes a use-after-free in GK2 when restoring a second save
game, when the List reg_t is still considered valid but the List
has moved due to a partial game restore.
In GK2, restoring a save game causes the segment manager to reset
in the middle of a kListFirstTrue call, which invalidates all
pointers and reg_ts to stored data. This means that when
kListFirstTrue tries to decrement the list recursion counter at
the end of iteration, it is writing to freed memory, potentially
resulting in heap corruption.
SCI3 added checks to prevent this from happening, but these checks
seem like they should have also been applied to some SCI2.1 games
as well (like GK2).
Since there should be no negative side-effect to this check, it
is applied universally to all SCI32 games.
This change invalidates earlier SCI32 save games, which separated
arrays and strings in an incompatible manner. Old save games
contain invalid references to a string segment which no longer
exists, and contain incompatible array structures that lack
critical type information.
No functionality change has been made with this commit. This avoids
setting and getting the reg_t members directly, and is the basis of any
future work on large SCI3 scripts (larger than 64KB)
SCI2 strings inherit from arrays, plus kArray and kString are almost the
same, so this is all possible. This is needed, as SCI scripts copy
strings on arrays and then process them as such (e.g. in RAMA and LSL7)
However, we really need to merge SCI2 array types with the SCI2 string
types, and ultimately merge the code with the SCI1 array and string types.
svn-id: r54340
This ensures that the pointer to the element that lookupArray() returned
won't be invalidated in case the array is reallocated because of
allocateArray() - same issue as in kClone()
svn-id: r54306
- Split SCI2 from SCI2.1 signature checks
- Added signature checking for the subops of the SCI2.1 kernel call kList
- Added support for calls to kAddToFront and kAddToEnd with 3 parameters (unimplemented code uncovered by the signature checks)
- Added a FIXME for a potential incorrect subop (uncovered by the signature checks), which might be related to the crashes in the demo of Torin's Passage
svn-id: r50861
If one of these is triggered for you, you can add an exception to
the error, together with a comment explaining why this exception
is necessary. Ideally after verifying that the cause is a script
bug and not a bug in our code...
svn-id: r50442
Colin Snover
Filippos Karapetis
Martin Kiewitz
Johannes Schickel
Willem Jan Palenstijn
Filippos Karapetis
Eugene Sandulenko
strangerke
Lars Skovlund
Max Horn