Fix wild-pointer crash in RadarClass::Plot_Radar_Pixel on LP64 (radar/Comms Center)

CODE/RADAR.CPP

@@ -809,7 +809,7 @@ void RadarClass::Plot_Radar_Pixel(CELL cell)
 		if (color == TBLACK) {
 			if (ZoomFactor > 1) {
 				void const *ptr;
-				long offset;
+				int32_t offset;	// icon-set header stores 32-bit offsets; must not be 8-byte long on LP64
 				int icon;
 
 				if (cellptr->TType != TEMPLATE_NONE) {

tests/radar_icon_offset_width_test.cpp

@@ -0,0 +1,68 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static int fail(char const *message)
+{
+	fprintf(stderr, "FAIL: %s\n", message);
+	return 1;
+}
+
+static int radar_uses_32_bit_icon_offsets(void)
+{
+	FILE *source = fopen("CODE/RADAR.CPP", "rb");
+	char *buffer;
+	long size;
+	int result;
+
+	if (!source) return 0;
+	if (fseek(source, 0, SEEK_END) != 0) {
+		fclose(source);
+		return 0;
+	}
+	size = ftell(source);
+	if (size < 0 || fseek(source, 0, SEEK_SET) != 0) {
+		fclose(source);
+		return 0;
+	}
+	buffer = (char *)malloc((size_t)size + 1);
+	if (!buffer) {
+		fclose(source);
+		return 0;
+	}
+	if (fread(buffer, 1, (size_t)size, source) != (size_t)size) {
+		free(buffer);
+		fclose(source);
+		return 0;
+	}
+	fclose(source);
+	buffer[size] = '\0';
+	result = strstr(buffer, "int32_t offset") != 0;
+	free(buffer);
+	return result;
+}
+
+int main()
+{
+	unsigned char iconset_header[40];
+	int32_t map_offset = 0x20;
+	int32_t icon_offset = 0x40;
+	int32_t read_map_offset = 0;
+	int32_t read_icon_offset = 0;
+
+	memset(iconset_header, 0, sizeof(iconset_header));
+	memcpy(iconset_header + 12, &icon_offset, sizeof(icon_offset));
+	memcpy(iconset_header + 28, &map_offset, sizeof(map_offset));
+	memset(iconset_header + 32, 0x7f, 4);
+
+	memcpy(&read_map_offset, iconset_header + 28, sizeof(read_map_offset));
+	memcpy(&read_icon_offset, iconset_header + 12, sizeof(read_icon_offset));
+	if (read_map_offset != map_offset || read_icon_offset != icon_offset) {
+		return fail("the 32-bit icon-set offsets were not read exactly");
+	}
+	if (!radar_uses_32_bit_icon_offsets()) {
+		return fail("RadarClass::Plot_Radar_Pixel does not read icon-set offsets as int32_t");
+	}
+	return 0;
+}

tests/run_script_tests.sh

@@ -334,6 +334,9 @@ trap 'rm -rf "$tmpdir"' EXIT
   "$ROOT_DIR/tests/move_point_direction_oob_test.cpp" "$ROOT_DIR/CODE/COORD.CPP" -Wl,-dead_strip -o "$tmpdir/move_point_direction_oob_test"
 "$tmpdir/move_point_direction_oob_test"
 
+"${CXX:-c++}" -std=gnu++98 "$ROOT_DIR/tests/radar_icon_offset_width_test.cpp" -o "$tmpdir/radar_icon_offset_width_test"
+(cd "$ROOT_DIR" && "$tmpdir/radar_icon_offset_width_test")
+
 "${CXX:-c++}" -std=gnu++98 -DENGLISH -DGAME_VERSION=0x00030003 -DINTERNET_OFF -DTRUE_FALSE_DEFINED -DVQADIRECT_SOUND=1 -DWIN32 -D_WINDOWS \
   -I"$ROOT_DIR/PORT/MAC/include" -I"$ROOT_DIR/WIN32LIB/INCLUDE" -I"$ROOT_DIR/WIN32LIB/KEYBOARD" \
   -I"$ROOT_DIR/WIN32LIB/DRAWBUFF" -I"$ROOT_DIR/WIN32LIB/IFF" -I"$ROOT_DIR/WIN32LIB/MISC" \