Normalize out-of-range pen colors from Lua

docs/changelog.txt

@@ -64,6 +64,7 @@ Template for new versions:
 ## Fixes
 - Fix broken weather lookup in ``World::ReadCurrentWeather``
 - Fixed a possible hang or assertion failure when pressing a hotkey while a DFHack GUI window was open but unfocused
+- In ``Screen`` module, Fix out-of-bounds color table access when Lua pens use ``COLOR_RESET``
 - `3dveins`: fix failure on embarks that cross midmap tiles
 - `aquifer`: make ``--skip-top`` and top-relative ``--levels`` take effect for the ``drain``, ``convert``, and ``add`` actions instead of being silently ignored
 - `autodump`: ``destroy`` no longer leaves the contents of destroyed containers in limbo or crashes when destroying unit-held items

library/LuaApi.cpp

@@ -238,8 +238,14 @@ static void decode_pen(lua_State *L, Pen &pen, int idx)
 
     get_char_field(L, &pen.ch, idx, "ch", 0);
 
+    // COLOR_RESET only has meaning on text consoles; substitute the Pen
+    // defaults so out-of-range colors can't reach the screen buffers
     get_int_field(L, &pen.fg, idx, "fg", 7);
+    if (pen.fg < 0 || pen.fg > COLOR_MAX)
+        pen.fg = COLOR_GREY;
     get_int_field(L, &pen.bg, idx, "bg", 0);
+    if (pen.bg < 0 || pen.bg > COLOR_MAX)
+        pen.bg = COLOR_BLACK;
 
     lua_getfield(L, idx, "bold");
     if (lua_isnil(L, -1))
@@ -253,7 +259,11 @@ static void decode_pen(lua_State *L, Pen &pen, int idx)
     get_int_or_closure_field(L, &pen.tile, idx, "tile", 0);
 
     bool tcolor = get_int_field(L, &pen.tile_fg, idx, "tile_fg", 7);
+    if (pen.tile_fg < 0 || pen.tile_fg > COLOR_MAX)
+        pen.tile_fg = COLOR_GREY;
     tcolor = get_int_field(L, &pen.tile_bg, idx, "tile_bg", 0) || tcolor;
+    if (pen.tile_bg < 0 || pen.tile_bg > COLOR_MAX)
+        pen.tile_bg = COLOR_BLACK;
 
     if (tcolor)
         pen.tile_mode = Pen::TileColor;

library/modules/Screen.cpp

@@ -179,17 +179,21 @@ static bool doSetTile_char(const Pen &pen, int x, int y, bool use_graphics)
         *flag &= flag_mask;
     }
 
-    uint8_t fg = pen.fg | (pen.bold << 3);
-    uint8_t bg = pen.bg;
+    // out-of-range colors (including COLOR_RESET, which only has meaning
+    // on text consoles) get the Pen defaults, grey text on black, so
+    // they can't reach the buffers
+    uint8_t fg = (pen.fg < 0 || pen.fg > COLOR_MAX ? COLOR_GREY : pen.fg)
+        | (pen.bold << 3);
+    uint8_t bg = pen.bg < 0 || pen.bg > COLOR_MAX ? COLOR_BLACK : pen.bg;
 
     if (pen.tile_mode == Screen::Pen::CharColor)
         *flag |= 2; // SCREENTEXPOS_FLAG_ADDCOLOR
     else if (pen.tile_mode == Screen::Pen::TileColor) {
         *flag |= 1; // SCREENTEXPOS_FLAG_GRAYSCALE
         if (pen.tile_fg)
-            fg = pen.tile_fg;
+            fg = pen.tile_fg < 0 || pen.tile_fg > COLOR_MAX ? COLOR_GREY : pen.tile_fg;
         if (pen.tile_bg)
-            bg = pen.tile_bg;
+            bg = pen.tile_bg < 0 || pen.tile_bg > COLOR_MAX ? COLOR_BLACK : pen.tile_bg;
     }
 
     if (pen.tile && use_graphics) {