changeset 13862:90fbb5c8a162 draft

(svn r18391) -Fix (r0): (Invalid) GRFs could trigger invalid reads.
author frosch <frosch@openttd.org>
date Thu, 03 Dec 2009 15:27:33 +0000
parents c2ec8545efe6
children 5e0d41f1c723
files src/gfx.cpp src/spriteloader/grf.cpp
diffstat 2 files changed, 11 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/gfx.cpp
+++ b/src/gfx.cpp
@@ -70,7 +70,7 @@
  */
 static Rect _invalid_rect;
 static const byte *_colour_remap_ptr;
-static byte _string_colourremap[3];
+static byte _string_colourremap[3]; ///< Recoloursprite for stringdrawing. The grf loader ensures, that ST_FONT sprites only use colours 0 to 2.
 
 enum {
 	DIRTY_BLOCK_HEIGHT   = 8,
--- a/src/spriteloader/grf.cpp
+++ b/src/spriteloader/grf.cpp
@@ -127,7 +127,11 @@
 				}
 
 				for (int x = 0; x < length; x++) {
-					data->m = ((sprite_type == ST_NORMAL && _palette_remap_grf[file_slot]) ? _palette_remap[*dest] : *dest);
+					switch (sprite_type) {
+						case ST_NORMAL: data->m = _palette_remap_grf[file_slot] ? _palette_remap[*dest] : *dest; break;
+						case ST_FONT:   data->m = min(*dest, 2u); break;
+						default:        data->m = *dest; break;
+					}
 					dest++;
 					data++;
 				}
@@ -148,7 +152,11 @@
 		dest = dest_orig;
 
 		for (int i = 0; i < sprite->width * sprite->height; i++) {
-			sprite->data[i].m = ((sprite_type == ST_NORMAL && _palette_remap_grf[file_slot]) ? _palette_remap[dest[i]] : dest[i]);
+			switch (sprite_type) {
+				case ST_NORMAL: sprite->data[i].m = _palette_remap_grf[file_slot] ? _palette_remap[dest[i]] : dest[i]; break;
+				case ST_FONT:   sprite->data[i].m = min(dest[i], 2u); break;
+				default:        sprite->data[i].m = dest[i]; break;
+			}
 		}
 	}