From cb2fa48d65ab4f151a91c3ac4624f49e0600f49f Mon Sep 17 00:00:00 2001 From: Zack Middleton Date: Tue, 18 Jun 2013 17:02:47 -0500 Subject: [PATCH] Only allow model meshes to have SHADER_MAX_VERTEXES - 1 vertexes The last index is used to check for buffer overflows. See RB_CheckOverflow and RB_EndSurface. --- code/renderergl1/tr_model.c | 24 ++++++++++++------------ code/renderergl1/tr_model_iqm.c | 8 ++++---- code/renderergl2/tr_model.c | 24 ++++++++++++------------ code/renderergl2/tr_model_iqm.c | 8 ++++---- 4 files changed, 32 insertions(+), 32 deletions(-) diff --git a/code/renderergl1/tr_model.c b/code/renderergl1/tr_model.c index bbac11ee..f9e2c3af 100644 --- a/code/renderergl1/tr_model.c +++ b/code/renderergl1/tr_model.c @@ -458,15 +458,15 @@ static qboolean R_LoadMD3 (model_t *mod, int lod, void *buffer, const char *mod_ LL(surf->ofsXyzNormals); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -736,17 +736,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char // numBoneReferences and BoneReferences generally seem to be unused // now do the checks that may fail. - if ( surf->numVerts > SHADER_MAX_VERTEXES ) + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -953,15 +953,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) { LL(surf->ofsVerts); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } diff --git a/code/renderergl1/tr_model_iqm.c b/code/renderergl1/tr_model_iqm.c index 8af77e3e..0c7d4665 100644 --- a/code/renderergl1/tr_model_iqm.c +++ b/code/renderergl1/tr_model_iqm.c @@ -318,17 +318,17 @@ qboolean R_LoadIQM( model_t *mod, void *buffer, int filesize, const char *mod_na } // check ioq3 limits - if ( mesh->num_vertexes > SHADER_MAX_VERTEXES ) + if ( mesh->num_vertexes >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, meshName[0] ? meshName : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, meshName[0] ? meshName : "a surface", mesh->num_vertexes ); return qfalse; } - if ( mesh->num_triangles*3 > SHADER_MAX_INDEXES ) + if ( mesh->num_triangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, meshName[0] ? meshName : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, meshName[0] ? meshName : "a surface", mesh->num_triangles ); return qfalse; } diff --git a/code/renderergl2/tr_model.c b/code/renderergl2/tr_model.c index 2c567afc..8feeab0e 100644 --- a/code/renderergl2/tr_model.c +++ b/code/renderergl2/tr_model.c @@ -495,17 +495,17 @@ static qboolean R_LoadMD3(model_t * mod, int lod, void *buffer, int bufferSize, LL(md3Surf->ofsXyzNormals); LL(md3Surf->ofsEnd); - if(md3Surf->numVerts > SHADER_MAX_VERTEXES) + if(md3Surf->numVerts >= SHADER_MAX_VERTEXES) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n", - modName, SHADER_MAX_VERTEXES, md3Surf->name[0] ? md3Surf->name : "a surface", + modName, SHADER_MAX_VERTEXES - 1, md3Surf->name[0] ? md3Surf->name : "a surface", md3Surf->numVerts ); return qfalse; } - if(md3Surf->numTriangles * 3 > SHADER_MAX_INDEXES) + if(md3Surf->numTriangles * 3 >= SHADER_MAX_INDEXES) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n", - modName, SHADER_MAX_INDEXES / 3, md3Surf->name[0] ? md3Surf->name : "a surface", + modName, ( SHADER_MAX_INDEXES / 3 ) - 1, md3Surf->name[0] ? md3Surf->name : "a surface", md3Surf->numTriangles ); return qfalse; } @@ -996,17 +996,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char // numBoneReferences and BoneReferences generally seem to be unused // now do the checks that may fail. - if ( surf->numVerts > SHADER_MAX_VERTEXES ) + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -1213,15 +1213,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) { LL(surf->ofsVerts); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } diff --git a/code/renderergl2/tr_model_iqm.c b/code/renderergl2/tr_model_iqm.c index 15e0fe78..43dece19 100644 --- a/code/renderergl2/tr_model_iqm.c +++ b/code/renderergl2/tr_model_iqm.c @@ -318,17 +318,17 @@ qboolean R_LoadIQM( model_t *mod, void *buffer, int filesize, const char *mod_na } // check ioq3 limits - if ( mesh->num_vertexes > SHADER_MAX_VERTEXES ) + if ( mesh->num_vertexes >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, meshName[0] ? meshName : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, meshName[0] ? meshName : "a surface", mesh->num_vertexes ); return qfalse; } - if ( mesh->num_triangles*3 > SHADER_MAX_INDEXES ) + if ( mesh->num_triangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, meshName[0] ? meshName : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, meshName[0] ? meshName : "a surface", mesh->num_triangles ); return qfalse; }