fix:speech/speech_dispacher:use spd_say instead of spd_sayf (#1176)
17f1a6e...
by
Stefan Wildemann <email address hidden>
feature: graphics: allow spiked lines for cliff and embarkments (#1174)
* feature: graphics: allow spiked lines for cliff and embarkments
This adds another drwing element to graphics system. It can produce
lines with spikes as used for cliffs on maps.
Additionally this adds embarlment support for map.
* review fixes.
Add changes requested by review, plus add paranoia check on xml
parameter.
13e550f...
by
Bastian Koppelmann <email address hidden>
fix:core:Fix buffer overflow for ticket #1167 (#1170)
* Refactor:Transform: Create transform func for a single point
we have a common pattern where we call transform() for a single point. We have
to specify the last 4 parameters as constants in a function with too
many parameters. So refactor this function to a simpler signature. While
at this, we also rename the function for easy distinction.
* Fix:Transform: Fix buffer overflow in transform_point_buf in ticket #1167
When displayitem_transform_holes() is called, we allocate a struct point buffer
of size count. Then we call transform_point_buf() to fill that buffer called
result. In this function we fill the buffer in a for loop that runs count times.
The buffer is indexed using result_idx which is incremented every loop
iteration. However, if we are in 3d mode (indicated by t->ddd), we call
transform_z_clip_if_necessary(). This can lead to the repetition of the current
loop iteration by decreasing the loop variable i by 1. Even though we decreased
i we still increment result_idx by 1. So from the point of view of result_idx we
are running the loop count+1 times. Thus, we write one element past the
allocated buffer.
To fix this we give the size of the allocated buffer to
transform_point_buf(). Then we check in the loop if the repetition of this
loop iteration would fit into the buffer. If not, we double the size of
the buffer and try again until we succeed.
Co-authored-by: Stefan Wildemann <email address hidden>
