Opened 17 years ago

Closed 17 years ago

Last modified 13 months ago

#529 closed defect (fixed)

class Sound: writing past array bounds

Reported by: SF/sir_kill_a_lot Owned by: fingolfin
Priority: normal Component: Engine: SCUMM
Keywords: Cc:
Game: Day of the Tentacle


ScummVM 0.2.7 CVS, Built on Oct 31 2002 07:14:27
(sound.cpp rev. 1.48)

I've discovered this bug while playing DOTT (German
Talkie, using monster.sou) on Win32. After the second
sentence in the first cutscene in the future all sound
effects were gone, only the music played on.
Instead of playing the sounds, the console
said "WARNING: startTalkSound: did not find sound at
offset xxxxxxxxx !!", I had to restart ScummVM to fix

I set a breackpoint in "Sound::startTalkSound" in
scumm/sound.cpp and saw, that "_mouthSyncTimes"
was written beyond its bounds.
"_mouthSyncTimes" has 52 elements but "num" was
set to 55. So the line "_mouthSyncTimes[i] = 0xFFFF;"
after the loop actually changed the var "offset_table" and
caused the warnings.

This array should be resized (why was its size initially
set to 52?) and perhaps the range checked or
something like that...

I attached a savegame of the cutscene, but it works
only for the german version (probably this bug doesn't
occur in the english one, german sentences/words are
mostly longer)

Ticket imported from: #633082. Ticket imported from: bugs/529.

Attachments (1)

tentacle.s06 (40.0 KB ) - added by SF/sir_kill_a_lot 17 years ago.
Savegame (German)

Download all attachments as: .zip

Change History (5)

by SF/sir_kill_a_lot, 17 years ago

Attachment: tentacle.s06 added

Savegame (German)

comment:1 by fingolfin, 17 years ago

I am not sure how we derive the size of that array anyway, but I
increased it to 64 entries (28 additional bytes shouldn't hurt us after all :-
). Hopefully that fixes the issue. I also added some asserts to make it
easier to detect such issues in the future.

comment:2 by fingolfin, 17 years ago

Owner: set to fingolfin
Resolution: fixed
Status: newclosed

comment:3 by SF/sir_kill_a_lot, 17 years ago

ScummVM 0.2.7 CVS Built on Nov 6 2002 04:00:55
Yes works perfectly, thx for fixing that.

comment:4 by digitall, 13 months ago

Component: --Unset--Engine: SCUMM
Game: Day of the Tentacle
Note: See TracTickets for help on using tickets.