H3DlgHintBar memory OOB

[RoseKavalier]

Not enough bytes were allocated.
Found by @ethernidee.

[Archer30]

Generated by my agent:

I reproduced this issue while developing an ERA plugin using H3DlgHintBar.

Environment:

• ERA 3.9.30
• 32-bit h3era HD.exe
• Visual Studio 2022, C++17
• Static CRT

The current implementation calls H3DlgTextPcx::Create(), casts the returned pointer to H3DlgHintBar*, and then assigns lastHint.

The relevant object sizes are:

• sizeof(H3DlgTextPcx) == 0x54
• sizeof(H3DlgHintBar) == 0x58

Therefore, the base factory allocates only 0x54 bytes, while lastHint is written at offset +0x54. This writes four bytes beyond the allocated object and can corrupt the following heap metadata. Casting the pointer to the derived type does not enlarge the allocation.

In my case, the corruption did not normally crash at the original write. The crashes appeared later after repeatedly opening and closing a custom dialog, including:

• reopening a Tavern dialog;
• closing the Tavern;
• leaving the Town screen;
• closing the game.

This delayed behavior initially made the crash look like a dialog-lifecycle or HD Mod hook problem.

I corrected both H3DlgHintBar::Create overloads locally by allocating storage for the complete H3DlgHintBar object before invoking the existing text-PCX constructor logic. I also added compile-time size checks for the 0x54 base and 0x58 derived layouts.

After applying that correction, the previous delayed crashes stopped reproducing through multiple staged A/B builds and repeated Tavern/Town teardown tests. Restoring the rest of the full dialog interface did not bring the crashes back.

This provides independent runtime confirmation that the out-of-bounds allocation identified by this PR can cause real delayed heap-corruption crashes under ERA. Both the modular implementation and generated single-header version should receive the correction.