From 7f2c60e372afe8c39346fc9ba0ad9fe50be5f045 Mon Sep 17 00:00:00 2001 From: Dominik Kreutzer Date: Fri, 12 Aug 2022 20:22:25 +0200 Subject: [PATCH] IMuseDigital: fix unaligned access If dispatchConvertMap is called with a map that contains a TEXT block and if the length of that block is not divisible by 4, using mapCurPos as an int32 pointer results in undefined behaviour, because it is unaligned. --- engines/scumm/imuse_digi/dimuse_dispatch.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/engines/scumm/imuse_digi/dimuse_dispatch.cpp b/engines/scumm/imuse_digi/dimuse_dispatch.cpp index ff0d7be7280..1ad0a52e253 100644 --- a/engines/scumm/imuse_digi/dimuse_dispatch.cpp +++ b/engines/scumm/imuse_digi/dimuse_dispatch.cpp @@ -1149,13 +1149,13 @@ int IMuseDigital::dispatchConvertMap(uint8 *rawMap, uint8 *destMap) { while (mapCurPos < endOfMapPtr) { // Swap32 the 4 characters block name int32 swapped = READ_BE_UINT32(mapCurPos); - *(int32 *)mapCurPos = swapped; + memcpy(mapCurPos, &swapped, 4); blockName = swapped; // Advance and Swap32 the block size (minus 8) field blockSizePtr = mapCurPos + 4; blockSizeMin8 = READ_BE_UINT32(blockSizePtr); - *(int32 *)blockSizePtr = blockSizeMin8; + memcpy(blockSizePtr, &blockSizeMin8, 4); mapCurPos = blockSizePtr + 4; // Swapping32 a TEXT block is different: @@ -1163,7 +1163,8 @@ int IMuseDigital::dispatchConvertMap(uint8 *rawMap, uint8 *destMap) { // since they're already good like this if (blockName == MKTAG('T', 'E', 'X', 'T')) { // Swap32 the block offset position - *(int32 *)mapCurPos = READ_BE_UINT32(mapCurPos); + swapped = READ_BE_UINT32(mapCurPos); + memcpy(mapCurPos, &swapped, 4); // Skip the single characters firstChar = mapCurPos + 4; @@ -1180,7 +1181,8 @@ int IMuseDigital::dispatchConvertMap(uint8 *rawMap, uint8 *destMap) { // ...and swap them of course do { - *(int32 *)mapCurPos = READ_BE_UINT32(mapCurPos); + swapped = READ_BE_UINT32(mapCurPos); + memcpy(mapCurPos, &swapped, 4); mapCurPos += 4; --remainingFieldsNum; } while (remainingFieldsNum); -- 2.37.1.windows.1