From 53f6d749df64ccb51b982c7505e6428da9933ec7 Mon Sep 17 00:00:00 2001
From: helixhorned <helixhorned@1a8010ca-5511-0410-912e-c29ae57300e0>
Date: Fri, 29 Mar 2013 15:59:23 +0000
Subject: [PATCH] Return early from A_IncurDamage() if actor[].picnum
 ("htpicnum" in CON) is < 0.

With this change, it is impossible for negative values to be used as array
indices inside this function, and I believe that it is also impossible that
they escape to somewhere they might be used as such.

For Lunatic, allow setting actor[].picnum to negative values and in the
translator, add (commented out) code to warn whenever it is set to a constant
negative value.  Also, fix a _sound call in _addphealth in control.lua.

git-svn-id: https://svn.eduke32.com/eduke32@3626 1a8010ca-5511-0410-912e-c29ae57300e0
---
 polymer/eduke32/source/actors.c            | 5 +++--
 polymer/eduke32/source/lunatic/control.lua | 2 +-
 polymer/eduke32/source/lunatic/defs.ilua   | 4 +++-
 polymer/eduke32/source/lunatic/lunacon.lua | 6 ++++++
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/polymer/eduke32/source/actors.c b/polymer/eduke32/source/actors.c
index ab744cdea..f2f136db8 100644
--- a/polymer/eduke32/source/actors.c
+++ b/polymer/eduke32/source/actors.c
@@ -889,7 +889,8 @@ int32_t A_IncurDamage(int32_t sn)
     spritetype *const targ = &sprite[sn];
     actor_t *const dmg = &actor[sn];
 
-    if (dmg->extra < 0 || targ->extra < 0)
+    // dmg->picnum check: safety, since it might have been set to <0 from CON.
+    if (dmg->extra < 0 || targ->extra < 0 || dmg->picnum < 0)
     {
         dmg->extra = -1;
         return -1;
@@ -1913,7 +1914,7 @@ ACTOR_STATIC void G_MoveStandables(void)
 
         if (s->picnum == FIREEXT)
         {
-            if (A_IncurDamage(i) == -1)
+            if (A_IncurDamage(i) < 0)
                 goto BOLT;
 
             for (k=0; k<16; k++)
diff --git a/polymer/eduke32/source/lunatic/control.lua b/polymer/eduke32/source/lunatic/control.lua
index 21c3eb55c..dc6dc6af6 100644
--- a/polymer/eduke32/source/lunatic/control.lua
+++ b/polymer/eduke32/source/lunatic/control.lua
@@ -1014,7 +1014,7 @@ function _addphealth(ps, aci, hlthadd)
         local qmaxhlth = bit.rshift(ps.max_player_health, 2)
         if (j-hlthadd < qmaxhlth and j >= qmaxhlth) then
             -- XXX: DUKE_GOTHEALTHATLOW
-            _sound(229, aci)
+            _sound(aci, 229)
         end
 
         ps.last_extra = j
diff --git a/polymer/eduke32/source/lunatic/defs.ilua b/polymer/eduke32/source/lunatic/defs.ilua
index c796fb187..7440bfa79 100644
--- a/polymer/eduke32/source/lunatic/defs.ilua
+++ b/polymer/eduke32/source/lunatic/defs.ilua
@@ -917,7 +917,9 @@ local actor_mt = {
         end,
 
         set_picnum = function(a, picnum)
-            check_tile_idx(picnum)
+            if (picnum >= 0) then
+                check_tile_idx(picnum)
+            end
             ffi.cast(actor_ptr_ct, a).picnum = picnum
         end,
 
diff --git a/polymer/eduke32/source/lunatic/lunacon.lua b/polymer/eduke32/source/lunatic/lunacon.lua
index 3532ed52e..e37d296c8 100644
--- a/polymer/eduke32/source/lunatic/lunacon.lua
+++ b/polymer/eduke32/source/lunatic/lunacon.lua
@@ -1596,6 +1596,12 @@ end
 local function SetStructCmd(accessfunc, pattern)
     local function capfunc(idx, memb, var)
         local membercode, ismethod = accessfunc(true, idx, memb)
+--[[
+        local member = memb[1]:lower()
+        if (type(var)=="number" and var<0 and member:match("picnum")) then
+            warnprintf("member '.%s' is set to a negative value", member)
+        end
+--]]
         if (ismethod) then
             -- METHOD_MEMBER syntax