IMAGE: Check the output surface bounds when writing QT encoded PICT i…

…mages
scummvm · Sep 14, 2018 · 360e1e9 · 360e1e9
1 parent f0f02c4
commit 360e1e9
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/image/pict.cpp b/image/pict.cpp
@@ -577,9 +577,14 @@ void PICTDecoder::decodeCompressedQuickTime(Common::SeekableReadStream &stream)
 		_outputSurface = new Graphics::Surface();
 		_outputSurface->create(_imageRect.width(), _imageRect.height(), surface->format);
 	}
+	assert(_outputSurface->format == surface->format);
 
-	for (uint16 y = 0; y < surface->h; y++)
-		memcpy(_outputSurface->getBasePtr(0 + xOffset, y + yOffset), surface->getBasePtr(0, y), surface->w * surface->format.bytesPerPixel);
+	Common::Rect outputRect(surface->w, surface->h);
+	outputRect.translate(xOffset, yOffset);
+	outputRect.clip(_imageRect);
+
+	for (uint16 y = 0; y < outputRect.height(); y++)
+		memcpy(_outputSurface->getBasePtr(outputRect.left, y + outputRect.top), surface->getBasePtr(0, y), outputRect.width() * surface->format.bytesPerPixel);
 
 	stream.seek(startPos + dataSize);
 	delete codec;