Opened 14 years ago

Closed 14 years ago

#2261 closed defect (fixed)

BS1: crash in load game dialog

Reported by: wjp Owned by: eriktorbjorn
Priority: normal Component: Engine: Sword1
Keywords: Cc:
Game: Broken Sword 1


If you have less than 8 savegames and press the page
down button in the restore game dialog, the game
crashes instantly.

saveNameScroll sets maxScroll to the number of
savegames, e.g., 1.,
and this causes _saveScrollPos to be set to -7, which
is translated to 249 because it's a uint8. Trying to
print the savegame name then corrupts overflows the 40
byte string buffer, corrupts the stack, and crashes.

Possible fixes:
Add "if (maxScroll < 8) maxScroll = 8;" after setting
maxScroll in saveNameScroll().

Alternatively, don't try to scroll at all if _saveFiles
< 8.

Ticket imported from: #1327972. Ticket imported from: bugs/2261.

Change History (2)

comment:1 by eriktorbjorn, 14 years ago

Owner: set to eriktorbjorn
Resolution: fixed
Status: newclosed

comment:2 by eriktorbjorn, 14 years ago

Should be fixed in CVS now. Thanks again!

Note: See TracTickets for help on using tickets.