Opened 15 months ago
Closed 15 months ago
#14578 closed defect (fixed)
SHERLOCK: ROSETATTOO: Incorrect talk history due to out-of-bounds access
Reported by: | PushmePullyu | Owned by: | sev- |
---|---|---|---|
Priority: | normal | Component: | Engine: Sherlock |
Version: | Keywords: | ||
Cc: | PushmePullyu | Game: | Sherlock Holmes: Case of the Rose Tattoo |
Description (last modified by )
Tested with master e0a146f9086ae523229d6e8173c39d290e669449 on Linux x86_64 using the English CD version of Rose Tattoo.
The talk history is held in
Common::Array<Sherlock::TalkHistoryEntry> Sherlock::Talk::_talkHistory
Every TalkHistoryEntry holds 16 bools, each corresponding to a statement:
engines/sherlock/talk.h:
struct TalkHistoryEntry { bool _data[16]; ... }
However, some talk files have more than 16 statements. Since this is never checked, it will lead to out-of-bounds writes/reads, accessing memory in the next TalkHistoryEntry instead.
Other than text color, incorrect talk history also affects recording of statements in the journal and updating the _holmesQuotient.
To reproduce with "WIGG01B.TLK" statement 17 (_talkHistory[984]._data[16]) and "SPIT36D.TLK" statement 1 (_talkHistory[985]._data[0]):
- Load attached save
- Talk to Wiggins; note that option 3 is not marked as used before (it should be shown brighter than option 1)
- Abort the talk without selecting any statement by pressing ESC
- Exit to the city map
- Go to Spitalfields (rightmost icon on the map)
- Exit to the city map
- Go back to 221B Baker St. (magnifying glass icon in the NW part of the city)
- Talk to Wiggins again; note that option 3 is now marked as used (it should be shown darker)
Notes:
- Rose Tattoo's "WATS02A.TLK" contains 31 statements, which seems to be the largest number used.
I did not test this with Scalpel nor do I know its maximum number of statements.- Scalpel's talk files never exceed 16 statements, so it is not affected by the problem
Attachments (1)
Change History (4)
by , 15 months ago
Attachment: | rosetattoo.016 added |
---|
comment:1 by , 15 months ago
Owner: | set to |
---|---|
Resolution: | → pending |
Status: | new → pending |
comment:2 by , 15 months ago
Description: | modified (diff) |
---|
comment:3 by , 15 months ago
Owner: | changed from | to
---|---|
Resolution: | pending → fixed |
Status: | pending → closed |
The PR has now been merged. Thank you!
PR for this is here: https://github.com/scummvm/scummvm/pull/5268