Apply patch from Debian fixing several overflows.

code/aliens.cpp

@@ -1105,8 +1105,8 @@ void doAliens()
 
 				// ----------------------------------------
 
-				Math::limitChar(&--theEnemy->reload[0], 0, 999);
+				Math::limitCharAdd(&theEnemy->reload[0], -1, 0, 999);
-				Math::limitChar(&--theEnemy->reload[1], 0, 999);
+				Math::limitCharAdd(&theEnemy->reload[1], -1, 0, 999);
 
     			if ((!(theEnemy->flags & FL_DISABLED)) && (!(theEnemy->flags & FL_NOFIRE)))
 				{
@@ -1154,7 +1154,7 @@ void doAliens()
 				}
 				else
 				{
-					Math::limitChar(&++theEnemy->ammo[0], 0, 250);
+					Math::limitCharAdd(&theEnemy->ammo[0], 1, 0, 250);
 				}
 				// -------------------------------------------------------
 
@@ -1185,7 +1185,7 @@ void doAliens()
 				if (theEnemy->hit)
 					shapeToUse += SHIP_HIT_INDEX;
 
-				Math::limitChar(&--theEnemy->hit, 0, 100);
+				Math::limitCharAdd(&theEnemy->hit, -1, 0, 100);
 
 				if ((theEnemy->x + theEnemy->image[0]->w > 0) && (theEnemy->x < 800) && (theEnemy->y + theEnemy->image[0]->h > 0) && (theEnemy->y < 600))
 				{

code/classes.h

@@ -107,6 +107,26 @@ class Math {
 			*in = high;
 	}
 
+	static void limitCharAdd(signed char *in, int add, int low, int high)
+	{
+		int tmp = (int)*in + add;
+		if (tmp < low)
+			tmp = low;
+		if (tmp > high)
+			tmp = high;
+		*in = tmp;
+	}
+
+	static void limitCharAdd(unsigned char *in, int add, int low, int high)
+	{
+		int tmp = (int)*in + add;
+		if (tmp < low)
+			tmp = low;
+		if (tmp > high)
+			tmp = high;
+		*in = tmp;
+	}
+
 	static void limitInt(int *in, int low, int high)
 	{
 		if (*in < low)

code/collectable.cpp

@@ -264,7 +264,7 @@ void doCollectables()
 						break;
 
 					case P_ROCKET:
-						Math::limitChar(&(player.ammo[1] += collectable->value), 0, currentGame.maxRocketAmmo);
+						Math::limitCharAdd(&player.ammo[1], collectable->value, 0, currentGame.maxRocketAmmo);
 						if (player.ammo[1] == currentGame.maxRocketAmmo)
 							sprintf(temp, "Rocket Ammo at Maximum");
 						else
@@ -284,7 +284,7 @@ void doCollectables()
 						break;
 
 					case P_PLASMA_RATE:
-						Math::limitChar(&(weapon[1].reload[0] -= 2), currentGame.maxPlasmaRate, 15);
+						Math::limitCharAdd(&weapon[1].reload[0], -2, currentGame.maxPlasmaRate, 15);
 						player.weaponType[0] = 1;
 						if (player.ammo[0] < 50)
 							player.ammo[0] = 50;
@@ -297,7 +297,7 @@ void doCollectables()
 						break;
 
 					case P_PLASMA_SHOT:
-						Math::limitChar(&(weapon[1].ammo[0] += 1), 1, currentGame.maxPlasmaOutput);
+						Math::limitCharAdd(&weapon[1].ammo[0], 1, 1, currentGame.maxPlasmaOutput);
 						if (player.ammo[0] < 50)
 							player.ammo[0] = 50;
 						Math::limitChar(&(player.ammo[0]), 0, currentGame.maxPlasmaAmmo);
@@ -310,7 +310,7 @@ void doCollectables()
 						break;
 
 					case P_PLASMA_DAMAGE:
-						Math::limitChar(&(weapon[1].damage += 1), 1, currentGame.maxPlasmaDamage);
+						Math::limitCharAdd(&weapon[1].damage, 1, 1, currentGame.maxPlasmaDamage);
 						if (player.ammo[0] < 50)
 							player.ammo[0] = 50;
 						Math::limitChar(&(player.ammo[0]), 0, currentGame.maxPlasmaAmmo);
@@ -345,7 +345,7 @@ void doCollectables()
 						break;
 
 					case P_PLASMA_AMMO:
-						Math::limitChar(&(player.ammo[0] += collectable->value), 0, currentGame.maxPlasmaAmmo);
+						Math::limitCharAdd(&player.ammo[0], collectable->value, 0, currentGame.maxPlasmaAmmo);
 						if (player.ammo[0] == currentGame.maxPlasmaAmmo)
 							sprintf(temp, "Plasma cells at Maximum");
 						else

code/misc.cpp

@@ -373,7 +373,7 @@ void doInfo()
 		return;
 
 	if ((!engine.keyState[SDLK_SPACE]) && (player.weaponType[1] == W_LASER) && (engine.eventTimer % 8 == 1))
-		Math::limitChar(&(--player.ammo[1]), 1, 255);
+		Math::limitCharAdd(&player.ammo[1], -1, 1, 255);
 
 	if ((engine.eventTimer < 30) && (player.shield <= engine.lowShield))
 		return;

code/player.cpp

@@ -107,7 +107,7 @@ void doPlayer()
 			{
 				if (engine.keyState[SDLK_SPACE])
 				{
-					Math::limitChar(&(++player.ammo[1]), 0, 200);
+					Math::limitCharAdd(&player.ammo[1], 1, 0, 200);
 				}
 				else
 				{
@@ -193,8 +193,8 @@ void doPlayer()
 				engine.keyState[SDLK_LSHIFT] = engine.keyState[SDLK_RSHIFT] = 0;
 			}
 
-			Math::limitChar(&--player.reload[0], 0, 999);
+			Math::limitCharAdd(&player.reload[0], -1, 0, 999);
-			Math::limitChar(&--player.reload[1], 0, 999);
+			Math::limitCharAdd(&player.reload[1], -1, 0, 999);
 
 			if (engine.keyState[SDLK_UP])
 			{
@@ -278,7 +278,7 @@ void doPlayer()
 			if (player.hit)
 				shapeToUse += SHIP_HIT_INDEX;
 
-			Math::limitChar(&--player.hit, 0, 100);
+			Math::limitCharAdd(&player.hit, -1, 0, 100);
 
 			graphics.blit(graphics.shipShape[shapeToUse], (int)player.x, (int)player.y);
 			if ((player.shield <= engine.lowShield) && (rand() % 5 < 1))

code/shop.cpp

@@ -504,7 +504,7 @@ void buy(int i)
 		case 3:
 			if (player.ammo[0] == currentGame.maxPlasmaAmmo)
 				{shopSelectedItem = -4; return;}
-			Math::limitChar(&(player.ammo[0] += 10), 0, currentGame.maxPlasmaAmmo);
+			Math::limitCharAdd(&player.ammo[0], 10, 0, currentGame.maxPlasmaAmmo);
 			break;
 		case 4:
 			if ((player.weaponType[1] == W_CHARGER) || (player.weaponType[1] == W_LASER))
@@ -543,7 +543,7 @@ void buy(int i)
 		case 8:
 			if (currentGame.maxPlasmaAmmo == 250)
 				{shopSelectedItem = -3; return;}
-			Math::limitChar(&(currentGame.maxPlasmaAmmo += 10), 0, 250);
+			Math::limitCharAdd(&currentGame.maxPlasmaAmmo, 10, 0, 250);
 			break;
 		case 9:
 			if ((player.weaponType[1] == W_CHARGER) || (player.weaponType[1] == W_LASER))
@@ -628,7 +628,7 @@ void sell(int i)
 			if (player.ammo[0] == 0)
 				{shopSelectedItem = -6; return;}
 			if (player.ammo[0] > 9)
-				Math::limitChar(&(player.ammo[0] -= 10), 0, currentGame.maxPlasmaAmmo);
+				Math::limitCharAdd(&player.ammo[0], -10, 0, currentGame.maxPlasmaAmmo);
 			else
 				player.ammo[0] = 0;
 			break;