BS1: crash in load game dialog
|Reported by:||wjp||Owned by:||eriktorbjorn|
|Game:||Broken Sword 1|
If you have less than 8 savegames and press the page
down button in the restore game dialog, the game
saveNameScroll sets maxScroll to the number of
savegames, e.g., 1.,
and this causes _saveScrollPos to be set to -7, which
is translated to 249 because it's a uint8. Trying to
print the savegame name then corrupts overflows the 40
byte string buffer, corrupts the stack, and crashes.
Add "if (maxScroll < 8) maxScroll = 8;" after setting
maxScroll in saveNameScroll().
Alternatively, don't try to scroll at all if _saveFiles
Ticket imported from: #1327972. Ticket imported from: bugs/2261.