From f61866a080d898e0ec9a8ef8ec56e8def1ac915d Mon Sep 17 00:00:00 2001 From: Daniel Gibson Date: Sun, 9 Dec 2018 04:23:41 +0100 Subject: [PATCH] Fix pot. Crash in idWinding2D::ExpandForAxialBox() it could happen that i is 1 but numPlanes is still 0 (=> if for i = 0: ( p[j] - p[i] ).LengthSqr() < 0.01f ) so planes[-1] would be accessed which of course is invalid and can crash --- idlib/geometry/Winding2D.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/idlib/geometry/Winding2D.cpp b/idlib/geometry/Winding2D.cpp index 3106d10..8978f1d 100644 --- a/idlib/geometry/Winding2D.cpp +++ b/idlib/geometry/Winding2D.cpp @@ -84,7 +84,7 @@ void idWinding2D::ExpandForAxialBox( const idVec2 bounds[2] ) { continue; } plane = Plane2DFromPoints( p[i], p[j], true ); - if ( i ) { + if ( numPlanes > 0 ) { if ( GetAxialBevel( planes[numPlanes-1], plane, p[i], bevel ) ) { planes[numPlanes++] = bevel; }