From 20bf310cba643859ad30aa43ca0fe25fd39ff5ad Mon Sep 17 00:00:00 2001 From: hendricks266 Date: Sat, 17 May 2014 12:36:03 +0000 Subject: [PATCH] Fix two Polymer crashes related to corrupted maps. git-svn-id: https://svn.eduke32.com/eduke32@4471 1a8010ca-5511-0410-912e-c29ae57300e0 --- polymer/eduke32/build/src/polymer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/polymer/eduke32/build/src/polymer.c b/polymer/eduke32/build/src/polymer.c index 94ab87c49..078c6049f 100644 --- a/polymer/eduke32/build/src/polymer.c +++ b/polymer/eduke32/build/src/polymer.c @@ -2884,7 +2884,7 @@ static void polymer_updatewall(int16_t wallnum) w = prwalls[wallnum]; s = prsectors[sectofwall]; invalid = s->invalidid; - if (nwallnum >= 0 && nwallnum < numwalls) + if (nwallnum >= 0 && nwallnum < numwalls && wal->nextsector >= 0 && wal->nextsector < numsectors) { ns = prsectors[wal->nextsector]; invalid += ns->invalidid; @@ -2969,7 +2969,7 @@ static void polymer_updatewall(int16_t wallnum) else xref = 0; - if (wal->nextsector < 0 || wal->nextsector >= numsectors) + if (wal->nextsector < 0 || wal->nextsector >= numsectors || !ns) { Bmemcpy(w->wall.buffer, &s->floor.buffer[(wallnum - sec->wallptr) * 5], sizeof(GLfloat) * 3); Bmemcpy(&w->wall.buffer[5], &s->floor.buffer[(wal->point2 - sec->wallptr) * 5], sizeof(GLfloat) * 3);