From dc7ad65bb0bc1ab0e4ce12e64fd96be9773d119c Mon Sep 17 00:00:00 2001
From: Daniel Gibson <metalcaedes@gmail.com>
Date: Fri, 4 Jun 2021 13:38:14 +0200
Subject: [PATCH] Fix crash in soft renderer

RE_Draw_StretchPicImplementation() would write up to
height+picupscale-1 lines.
That overflows the buffer so make sure it doesn't.
---
 src/client/refresh/soft/sw_draw.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/client/refresh/soft/sw_draw.c b/src/client/refresh/soft/sw_draw.c
index 38e90140..08f55f23 100644
--- a/src/client/refresh/soft/sw_draw.c
+++ b/src/client/refresh/soft/sw_draw.c
@@ -245,10 +245,11 @@ RE_Draw_StretchPicImplementation (int x, int y, int w, int h, const image_t *pic
 				if (picupscale > 1)
 				{
 					int i;
+					int pu = min(height-v, picupscale);
 					pixel_t	*dest_orig = dest;
 
 					// copy first line to fill whole sector
-					for (i=1; i < picupscale; i++)
+					for (i=1; i < pu; i++)
 					{
 						// go to next line
 						dest += vid_buffer_width;