Ticket #9216: scummvm-overflow.patch

engines/agi/predictive.cpp

@@ -461 +461 @@
         }
 
  press:
-        strncpy(_predictiveResult, prefix.c_str(), 40);
-        strncat(_predictiveResult, _currentWord.c_str(), 40);
-        _predictiveResult[prefix.size() + _currentCode.size() + 1] = 0;
+        strncpy(_predictiveResult, prefix.c_str(), sizeof(_predictiveResult));
+        _predictiveResult[sizeof(_predictiveResult) - 1]= 0;
+        strncat(_predictiveResult, _currentWord.c_str(), sizeof(_predictiveResult)-strlen(_predictiveResult)-1);
+        _predictiveResult[prefix.size() + _currentCode.size()] = 0;
 
  getout:
         // if another window was shown, bring it up again

engines/parallaction/balloons.cpp

@@ -248 +248 @@
         Parallaction_ns *_vm;
         static int16 _dialogueBalloonX[5];
 
-        byte _textColors[2];
+        byte _textColors[3];
 
         struct Balloon {
                 Common::Rect outerBox;
@@ -530 +530 @@
 class BalloonManager_br : public BalloonManager {
 
         Parallaction_br *_vm;
-        byte _textColors[2];
+        byte _textColors[3];
 
         struct Balloon {
                 Common::Rect box;