zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-11-11 07:11:39 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add bounds checking for renderSetTarget()

Browse source 
I'm not aware of this problem actually occurring anywhere, but too many consecutive calls to renderSetTarget() without the appropriate calls to renderRestoreTarget() between them would overflow 5 different arrays.

git-svn-id: https://svn.eduke32.com/eduke32@7593 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
terminx 2019-04-18 17:24:37 +00:00 committed by Christoph Oelckers
parent 80d77f64cf
commit a628b8d9f7
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
source/build/src/engine.cpp
View file

@ -1457,10 +1457,12 @@ int16_t searchbottomwall, searchisbottom;
char inpreparemirror = 0, mirrorrender = 0; char inpreparemirror = 0, mirrorrender = 0;
static int32_t mirrorsx1, mirrorsy1, mirrorsx2, mirrorsy2; static int32_t mirrorsx1, mirrorsy1, mirrorsx2, mirrorsy2;
#define MAXSETVIEW 4
static int32_t setviewcnt = 0; // interface layers use this now static int32_t setviewcnt = 0; // interface layers use this now
static intptr_t bakframeplace[4]; static intptr_t bakframeplace[MAXSETVIEW];
static int32_t bakxsiz[4], bakysiz[4]; static int32_t bakxsiz[MAXSETVIEW], bakysiz[MAXSETVIEW];
static vec2_t bakwindowxy1[4], bakwindowxy2[4]; static vec2_t bakwindowxy1[MAXSETVIEW], bakwindowxy2[MAXSETVIEW];
#ifdef USE_OPENGL #ifdef USE_OPENGL
static int32_t bakrendmode; static int32_t bakrendmode;
#endif #endif
@ -11532,6 +11534,9 @@ void videoClearScreen(int32_t dacol)
// //
void renderSetTarget(int16_t tilenume, int32_t xsiz, int32_t ysiz) void renderSetTarget(int16_t tilenume, int32_t xsiz, int32_t ysiz)
{ {
if (setviewcnt >= MAXSETVIEW-1)
return;
//DRAWROOMS TO TILE BACKUP&SET CODE //DRAWROOMS TO TILE BACKUP&SET CODE
tilesiz[tilenume].x = xsiz; tilesiz[tilenume].y = ysiz; tilesiz[tilenume].x = xsiz; tilesiz[tilenume].y = ysiz;
bakxsiz[setviewcnt] = xsiz; bakysiz[setviewcnt] = ysiz; bakxsiz[setviewcnt] = xsiz; bakysiz[setviewcnt] = ysiz;