zdoom
/
raze-gles
mirror of https://github.com/ZDoom/raze-gles.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add bounds checking for renderSetTarget() 

I'm not aware of this problem actually occurring anywhere, but too many consecutive calls to renderSetTarget() without the appropriate calls to renderRestoreTarget() between them would overflow 5 different arrays.

git-svn-id: https://svn.eduke32.com/eduke32@7593 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
terminx 2019-04-18 17:24:37 +00:00 committed by Christoph Oelckers
parent 80d77f64cf
commit a628b8d9f7
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
source/build/src/engine.cpp
View File

@ -1457,10 +1457,12 @@ int16_t searchbottomwall, searchisbottom;
char inpreparemirror = 0, mirrorrender = 0;
static int32_t mirrorsx1, mirrorsy1, mirrorsx2, mirrorsy2;
#define MAXSETVIEW 4
static int32_t setviewcnt = 0; // interface layers use this now
static intptr_t bakframeplace[4];
static int32_t bakxsiz[4], bakysiz[4];
static vec2_t bakwindowxy1[4], bakwindowxy2[4];
static intptr_t bakframeplace[MAXSETVIEW];
static int32_t bakxsiz[MAXSETVIEW], bakysiz[MAXSETVIEW];
static vec2_t bakwindowxy1[MAXSETVIEW], bakwindowxy2[MAXSETVIEW];
#ifdef USE_OPENGL
static int32_t bakrendmode;
#endif
@ -11532,6 +11534,9 @@ void videoClearScreen(int32_t dacol)
//
void renderSetTarget(int16_t tilenume, int32_t xsiz, int32_t ysiz)
{
if (setviewcnt >= MAXSETVIEW-1)
return;
//DRAWROOMS TO TILE BACKUP&SET CODE
tilesiz[tilenume].x = xsiz; tilesiz[tilenume].y = ysiz;
bakxsiz[setviewcnt] = xsiz; bakysiz[setviewcnt] = ysiz;