AVALANCHE: Fix a couple of (theoretical) out of bounds accesses (CID …

…1109650)
scummvm · Oct 24, 2013 · 29033e3 · 29033e3
1 parent d04a86c
commit 29033e3
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 7 deletions.
diff --git a/engines/avalanche/avalot.cpp b/engines/avalanche/avalot.cpp
@@ -1229,7 +1229,7 @@ void AvalancheEngine::checkClick() {
 					_parser->_thing += 49;
 					_parser->_person = kPeoplePardon;
 				} else {
-					_parser->_person = (People) _thinks;
+					_parser->_person = (People)_thinks;
 					_parser->_thing = _parser->kPardon;
 				}
 				callVerb(kVerbCodeExam);

diff --git a/engines/avalanche/parser.cpp b/engines/avalanche/parser.cpp
@@ -1015,10 +1015,13 @@ bool Parser::isHolding() {
 
 	if (_thing > 100)
 		_vm->_dialogs->displayText("Be reasonable!");
-	else if (!_vm->_objects[_thing - 1])
-		// Verbs that need "_thing" to be in the inventory.
-		_vm->_dialogs->displayText("You're not holding it, Avvy.");
-	else
+	else if (_thing <= kObjectNum) {
+		if (!_vm->_objects[_thing - 1])
+			// Verbs that need "_thing" to be in the inventory.
+			_vm->_dialogs->displayText("You're not holding it, Avvy.");
+		else
+			holdingResult = true;
+	} else
 		holdingResult = true;
 
 	return holdingResult;
@@ -1053,8 +1056,10 @@ void Parser::examine() {
 				examineObject();
 			else if ((50 <= _thing) && (_thing <= 100)) {
 				// Also _thing
+				int id = _thing - 50;
+				assert(id < 31);
 				openBox(true);
-				_vm->_dialogs->displayText(*_vm->_also[_thing - 50][1]);
+				_vm->_dialogs->displayText(*_vm->_also[id][1]);
 				openBox(false);
 			}
 		}

diff --git a/engines/avalanche/parser.h b/engines/avalanche/parser.h
@@ -66,7 +66,7 @@ class Parser {
 	Common::String _inputText; // Original name: current
 	Common::String _inputTextBackup;
 	byte _inputTextPos; // Original name: curpos
-	bool _quote; // 66 or 99 next?
+	bool _quote;
 	bool _cursorState;
 	bool _weirdWord;