From e3ccf198a59306210f52376e2db8f14212f6336c Mon Sep 17 00:00:00 2001 From: kernaltrap Date: Wed, 28 May 2025 22:23:01 -0500 Subject: [PATCH] Fix integer overflow in `LegoAnimationManager::Tickle` This PR fixes a integer overflow in the `rand()` call inside of `LegoAnimationManager::Tickle`. During animation sequences, like the one that plays when you first get in-game and the Infomaniac tells you about the Pizzeria, the `rand` function could return a massive value that would overflow the `int` type of `MxLong`. Signed-off-by: kernaltrap --- LEGO1/lego/legoomni/src/common/legoanimationmanager.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/LEGO1/lego/legoomni/src/common/legoanimationmanager.cpp b/LEGO1/lego/legoomni/src/common/legoanimationmanager.cpp index a54e421d..e146aa51 100644 --- a/LEGO1/lego/legoomni/src/common/legoanimationmanager.cpp +++ b/LEGO1/lego/legoomni/src/common/legoanimationmanager.cpp @@ -1562,7 +1562,8 @@ MxResult LegoAnimationManager::Tickle() return SUCCESS; } - m_unk0x410 = (rand() * 10000 / SHRT_MAX) + 5000; + MxLong r = rand() % 32768; + m_unk0x410 = (r * 10000 / 32767) + 5000; m_unk0x408 = time; if (time - m_unk0x404 > 10000) { @@ -1585,6 +1586,7 @@ MxResult LegoAnimationManager::Tickle() return SUCCESS; } + // FUNCTION: LEGO1 0x10062110 // FUNCTION: BETA10 0x10042f41 MxU16 LegoAnimationManager::FUN_10062110(