- Added a range check for the PNG grAb chunks.

- Fixed: AddLine() could corrupt memory if the length of the text being
  added was longer than the console buffer.
- Fixed: FTexture::GetScaled(Left|Top)Offset returned the Width and Height
  instead when the scale values were 0.
- Removed the unnecessary "mov ecx,c" from mscinlines.h:Scale().


SVN r461 (trunk)

docs/rh-log.txt

@@ -1,4 +1,10 @@
 January 22, 2007
+- Added a range check for the PNG grAb chunks.
+- Fixed: AddLine() could corrupt memory if the length of the text being
+  added was longer than the console buffer.
+- Fixed: FTexture::GetScaled(Left|Top)Offset returned the Width and Height
+  instead when the scale values were 0.
+- Removed the unnecessary "mov ecx,c" from mscinlines.h:Scale().
 - Fixed: The simulated palette blend used when the console is down needs to
   force a full screen update the next frame.
 - Fixed: LocalViewPitch could overflow and wrap around when a netgame stalls.

src/c_console.cpp

@@ -637,6 +637,11 @@ static void AddLine (const char *text, bool more, int len)
 		TopLine = FlushLines (BufferRover, ConsoleBuffer + CONSOLESIZE);
 		BufferRover = ConsoleBuffer;
 	}
+	if (len >= CONSOLESIZE - 1)
+	{
+		text = text + len - CONSOLESIZE + 1;
+		len = CONSOLESIZE - 1;
+	}
 	TopLine = FlushLines (BufferRover, BufferRover + len + 1);
 	memcpy (BufferRover, text, len);
 	BufferRover[len] = 0;

src/mscinlines.h

@@ -23,9 +23,8 @@
 __forceinline SDWORD Scale (SDWORD a, SDWORD b, SDWORD c)
 {
 	__asm mov eax,a
-	__asm mov ecx,c
 	__asm imul b
-	__asm idiv ecx
+	__asm idiv c
 }
 
 __forceinline SDWORD MulScale (SDWORD a, SDWORD b, SDWORD c)

src/r_defs.h

@@ -652,8 +652,8 @@ public:
 	int GetScaledWidth () { return ScaleX ? DivScale3(Width, ScaleX) : Width; }
 	int GetScaledHeight () { return ScaleY ? DivScale3(Height, ScaleY) : Height; }
 
-	int GetScaledLeftOffset () { return ScaleX ? DivScale3(LeftOffset, ScaleX) : Width; }
-	int GetScaledTopOffset () { return ScaleY ? DivScale3(TopOffset, ScaleY) : Height; }
+	int GetScaledLeftOffset () { return ScaleX ? DivScale3(LeftOffset, ScaleX) : LeftOffset; }
+	int GetScaledTopOffset () { return ScaleY ? DivScale3(TopOffset, ScaleY) : TopOffset; }
 
 	virtual void SetFrontSkyLayer();
 

src/textures/pngtexture.cpp

@@ -154,10 +154,23 @@ FPNGTexture::FPNGTexture (FileReader &lump, int lumpnum, int width, int height,
 			// This is like GRAB found in an ILBM, except coordinates use 4 bytes
 			{
 				DWORD hotx, hoty;
+				int ihotx, ihoty;
 				
 				lump >> hotx >> hoty;
-				LeftOffset = BigLong((int)hotx);
-				TopOffset = BigLong((int)hoty);
+				ihotx = BigLong((int)hotx);
+				ihoty = BigLong((int)hoty);
+				if (ihotx < -32768 || ihotx > 32767)
+				{
+					Printf ("X-Offset for PNG texture %s is bad: %d (0x%08x)\n", Wads.GetLumpFullName (lumpnum), ihotx, ihotx);
+					ihotx = 0;
+				}
+				if (ihoty < -32768 || ihoty > 32767)
+				{
+					Printf ("Y-Offset for PNG texture %s is bad: %d (0x%08x)\n", Wads.GetLumpFullName (lumpnum), ihoty, ihoty);
+					ihoty = 0;
+				}
+				LeftOffset = (int)ihotx;
+				TopOffset = (int)ihoty;
 			}
 			break;