fte/quakespasm
2
0
Fork 0
mirror of https://github.com/Shpoike/Quakespasm.git synced 2025-02-02 14:01:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

Mod_DecompressVis: don't overflow output buffer given invalid visdata

Browse source 
Fixes crash on death32c.bsp:
http://sourceforge.net/p/quakespasm/bugs/25/

git-svn-id: svn://svn.code.sf.net/p/quakespasm/code/trunk/quakespasm@1548 af15c1b1-3010-417e-b628-4374ebc0bcbd
This commit is contained in:
Eric Wasylishen 2018-01-08 05:02:14 +00:00
parent e4b71e6268
commit 413272b977
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
Quake/gl_model.c
View file

@ -132,6 +132,7 @@ byte *Mod_DecompressVis (byte *in, qmodel_t *model)
{
int c;
byte *out;
byte *outend;
int row;
row = (model->numleafs+7)>>3;
@ -143,6 +144,7 @@ byte *Mod_DecompressVis (byte *in, qmodel_t *model)
Sys_Error ("Mod_DecompressVis: realloc() failed on %d bytes", mod_decompressed_capacity);
}
out = mod_decompressed;
outend = mod_decompressed + row;
#if 0
memcpy (out, in, row);
@ -169,6 +171,16 @@ byte *Mod_DecompressVis (byte *in, qmodel_t *model)
in += 2;
while (c)
{
if (out == outend)
{
static qboolean warned = false;
if (!warned)
{
warned = true;
Con_Printf("Mod_DecompressVis: output overrun on model \"%s\"\n", model->name);
}
return mod_decompressed;
}
*out++ = 0;
c--;
}