zdoom
/
gzdoom
mirror of https://github.com/ZDoom/gzdoom.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add texturefrac bounds clamping to R_DrawMaskedColumn to avoid buffer overruns

This commit is contained in:
Magnus Norddahl 2016-11-04 02:03:23 +01:00 committed by Christoph Oelckers
parent b04118032e
commit 4b4d7a0768
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/r_things.cpp
View File

@ -281,6 +281,15 @@ void R_DrawMaskedColumn (const BYTE *column, const FTexture::Span *span, bool us
dc_source = column;
dc_dest = (ylookup[dc_yl] + dc_x) + dc_destorg;
dc_count = dc_yh - dc_yl + 1;
fixed_t maxfrac = ((top + length) << FRACBITS) - 1;
dc_texturefrac = MAX(dc_texturefrac, 0);
dc_texturefrac = MIN(dc_texturefrac, maxfrac);
if (dc_iscale > 0)
dc_count = MIN(dc_count, (maxfrac - dc_texturefrac + dc_iscale - 1) / dc_iscale);
else if (dc_iscale < 0)
dc_count = MIN(dc_count, (dc_texturefrac - dc_iscale) / (-dc_iscale));
if (useRt)
hcolfunc_pre();
else