From 5f263f13587188bd7e95b81196a9fc9c65ca6acc Mon Sep 17 00:00:00 2001 From: helixhorned Date: Tue, 30 Dec 2014 20:05:20 +0000 Subject: [PATCH] engine.c: prevent an oob read of spriteext[] in drawsprite_classic(). git-svn-id: https://svn.eduke32.com/eduke32@4872 1a8010ca-5511-0410-912e-c29ae57300e0 --- polymer/eduke32/build/src/engine.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/polymer/eduke32/build/src/engine.c b/polymer/eduke32/build/src/engine.c index 878c2cd12..e6256b7a0 100644 --- a/polymer/eduke32/build/src/engine.c +++ b/polymer/eduke32/build/src/engine.c @@ -5643,24 +5643,25 @@ static void drawsprite_classic(int32_t snum) int32_t vtilenum = 0; spritetype *const tspr = tspriteptr[snum]; - - const int32_t xb = spritesxyz[snum].x; - const int32_t yp = spritesxyz[snum].y; - const int32_t spritenum = tspr->owner; const int32_t sectnum = tspr->sectnum; - const sectortype *const sec = (sectnum>=0) ? §or[sectnum] : NULL; - int32_t tilenum; - int32_t cstat = tspr->cstat; - uint8_t blendidx = tspr->blend; - float alpha = spriteext[spritenum].alpha; - - if (sec == NULL) + if (sectnum < 0) return; if (bad_tspr(tspr)) return; + uint8_t blendidx = tspr->blend; + const int32_t xb = spritesxyz[snum].x; + const int32_t yp = spritesxyz[snum].y; + + const int32_t spritenum = tspr->owner; + const float alpha = spriteext[spritenum].alpha; + + const sectortype *const sec = §or[sectnum]; + + int32_t cstat=tspr->cstat, tilenum; + DO_TILE_ANIM(tspr->picnum, spritenum+32768); if (alpha > 0.0f)