zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-12-25 03:00:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

premap.c: fix oob access of tagbitmap[] with formerly negative lo-/hitags.

Browse source 
Also, allocate that array dynamically instead of on the stack.

git-svn-id: https://svn.eduke32.com/eduke32@3592 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2013-03-21 10:20:37 +00:00
parent ad55e2d424
commit 95b1a2a791
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
polymer/eduke32/source/premap.c
View file

@ -1063,9 +1063,10 @@ static inline void prelevel(char g)
{ {
int32_t i, nexti, j, startwall, endwall; int32_t i, nexti, j, startwall, endwall;
int32_t switchpicnum; int32_t switchpicnum;
uint8_t *tagbitmap = Bcalloc(65536>>3, 1);
uint8_t tagbitmap[65536>>3]; // XXX: allocating 8k on the stack isn't that great if (tagbitmap==NULL)
Bmemset(tagbitmap, 0, sizeof(tagbitmap)); G_GameExit("OUT OF MEMORY in prelevel()");
Bmemset(show2dsector, 0, sizeof(show2dsector)); Bmemset(show2dsector, 0, sizeof(show2dsector));
Bmemset(show2dsprite, 0, sizeof(show2dsprite)); Bmemset(show2dsprite, 0, sizeof(show2dsprite));
@ -1232,7 +1233,7 @@ static inline void prelevel(char g)
// the lower code only for the 'on' state (*) // the lower code only for the 'on' state (*)
if (ii==0) if (ii==0)
{ {
j = sprite[i].lotag+32768; j = sprite[i].lotag;
tagbitmap[j>>3] |= 1<<(j&7); tagbitmap[j>>3] |= 1<<(j&7);
} }
@ -1243,12 +1244,13 @@ static inline void prelevel(char g)
// initially 'on' SE 12 light (*) // initially 'on' SE 12 light (*)
for (j=headspritestat[STAT_EFFECTOR]; j>=0; j=nextspritestat[j]) for (j=headspritestat[STAT_EFFECTOR]; j>=0; j=nextspritestat[j])
{ {
int32_t t = sprite[j].hitag+32768; int32_t t = sprite[j].hitag;
if (sprite[j].lotag == SE_12_LIGHT_SWITCH && tagbitmap[t>>3]&(1<<(t&7))) if (sprite[j].lotag == SE_12_LIGHT_SWITCH && tagbitmap[t>>3]&(1<<(t&7)))
actor[j].t_data[0] = 1; actor[j].t_data[0] = 1;
} }
Bfree(tagbitmap);
g_mirrorCount = 0; g_mirrorCount = 0;