mirror of
https://github.com/UberGames/lilium-voyager.git
synced 2024-12-13 05:31:29 +00:00
Fix crash from reading past end of tr.refdef.drawSurfs
The number of draw surfaces was range checked against number of surfaces for the current view but needs to check total for the frame otherwise can read past the end of the tr.refdef.drawSurfs array when there are multiple views.
This commit is contained in:
parent
8531162bd9
commit
e6209f3b7c
2 changed files with 20 additions and 16 deletions
|
@ -1146,13 +1146,6 @@ void R_SortDrawSurfs( drawSurf_t *drawSurfs, int numDrawSurfs ) {
|
|||
return;
|
||||
}
|
||||
|
||||
// if we overflowed MAX_DRAWSURFS, the drawsurfs
|
||||
// wrapped around in the buffer and we will be missing
|
||||
// the first surfaces, not the last ones
|
||||
if ( numDrawSurfs > MAX_DRAWSURFS ) {
|
||||
numDrawSurfs = MAX_DRAWSURFS;
|
||||
}
|
||||
|
||||
// sort the drawsurfs by sort type, then orientation, then shader
|
||||
R_RadixSort( drawSurfs, numDrawSurfs );
|
||||
|
||||
|
@ -1361,6 +1354,7 @@ or a mirror / remote location
|
|||
*/
|
||||
void R_RenderView (viewParms_t *parms) {
|
||||
int firstDrawSurf;
|
||||
int numDrawSurfs;
|
||||
|
||||
if ( parms->viewportWidth <= 0 || parms->viewportHeight <= 0 ) {
|
||||
return;
|
||||
|
@ -1383,7 +1377,15 @@ void R_RenderView (viewParms_t *parms) {
|
|||
|
||||
R_GenerateDrawSurfs();
|
||||
|
||||
R_SortDrawSurfs( tr.refdef.drawSurfs + firstDrawSurf, tr.refdef.numDrawSurfs - firstDrawSurf );
|
||||
// if we overflowed MAX_DRAWSURFS, the drawsurfs
|
||||
// wrapped around in the buffer and we will be missing
|
||||
// the first surfaces, not the last ones
|
||||
numDrawSurfs = tr.refdef.numDrawSurfs;
|
||||
if ( numDrawSurfs > MAX_DRAWSURFS ) {
|
||||
numDrawSurfs = MAX_DRAWSURFS;
|
||||
}
|
||||
|
||||
R_SortDrawSurfs( tr.refdef.drawSurfs + firstDrawSurf, numDrawSurfs - firstDrawSurf );
|
||||
|
||||
// draw main system development information (surface outlines, etc)
|
||||
R_DebugGraphics();
|
||||
|
|
|
@ -1820,13 +1820,6 @@ void R_SortDrawSurfs( drawSurf_t *drawSurfs, int numDrawSurfs ) {
|
|||
return;
|
||||
}
|
||||
|
||||
// if we overflowed MAX_DRAWSURFS, the drawsurfs
|
||||
// wrapped around in the buffer and we will be missing
|
||||
// the first surfaces, not the last ones
|
||||
if ( numDrawSurfs > MAX_DRAWSURFS ) {
|
||||
numDrawSurfs = MAX_DRAWSURFS;
|
||||
}
|
||||
|
||||
// sort the drawsurfs by sort type, then orientation, then shader
|
||||
R_RadixSort( drawSurfs, numDrawSurfs );
|
||||
|
||||
|
@ -2053,6 +2046,7 @@ or a mirror / remote location
|
|||
*/
|
||||
void R_RenderView (viewParms_t *parms) {
|
||||
int firstDrawSurf;
|
||||
int numDrawSurfs;
|
||||
|
||||
if ( parms->viewportWidth <= 0 || parms->viewportHeight <= 0 ) {
|
||||
return;
|
||||
|
@ -2075,7 +2069,15 @@ void R_RenderView (viewParms_t *parms) {
|
|||
|
||||
R_GenerateDrawSurfs();
|
||||
|
||||
R_SortDrawSurfs( tr.refdef.drawSurfs + firstDrawSurf, tr.refdef.numDrawSurfs - firstDrawSurf );
|
||||
// if we overflowed MAX_DRAWSURFS, the drawsurfs
|
||||
// wrapped around in the buffer and we will be missing
|
||||
// the first surfaces, not the last ones
|
||||
numDrawSurfs = tr.refdef.numDrawSurfs;
|
||||
if ( numDrawSurfs > MAX_DRAWSURFS ) {
|
||||
numDrawSurfs = MAX_DRAWSURFS;
|
||||
}
|
||||
|
||||
R_SortDrawSurfs( tr.refdef.drawSurfs + firstDrawSurf, numDrawSurfs - firstDrawSurf );
|
||||
|
||||
// draw main system development information (surface outlines, etc)
|
||||
R_DebugGraphics();
|
||||
|
|
Loading…
Reference in a new issue