$OpenBSD: patch-engines_mads_palette_cpp,v 1.1 2017/05/29 12:13:43 sthen Exp $

MADS: Fix two off-by-ones in Fader::insertionSort

Commit 407187161038403f4d5e1ea35841379edfcef47a upstream.

Index: engines/mads/palette.cpp
--- engines/mads/palette.cpp.orig
+++ engines/mads/palette.cpp
@@ -665,15 +665,15 @@ void Fader::insertionSort(int size, byte *id, byte *va
 
 				int moveCount = size - arrIndex - 1;
 				if (moveCount > 0) {
-					Common::copy(idP + 1, idP + moveCount + 2, idP);
-					Common::copy(valueP + 1, valueP + moveCount + 2, valueP);
+					Common::copy(idP + 1, idP + moveCount + 1, idP);
+					Common::copy(valueP + 1, valueP + moveCount + 1, valueP);
 				}
 
 				// Scan for insert spot
 				int idx = 0;
 				if (endIndex > 0) {
 					bool breakFlag = false;
-					for (; idx <= endIndex && !breakFlag; ++idx) {
+					for (; idx <= endIndex - 1 && !breakFlag; ++idx) {
 						breakFlag = savedId < id[idx];
 					}
 				}
