From c9943bcde0d5778df7a27010606ad0e669e771fd Mon Sep 17 00:00:00 2001 From: helixhorned Date: Sat, 13 Dec 2014 22:33:02 +0000 Subject: [PATCH] engine.c: prevent an oob access of uwall[] in ceilspritescan(). git-svn-id: https://svn.eduke32.com/eduke32@4810 1a8010ca-5511-0410-912e-c29ae57300e0 --- polymer/eduke32/build/src/engine.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/polymer/eduke32/build/src/engine.c b/polymer/eduke32/build/src/engine.c index 7310e328c..5f1aa4f37 100644 --- a/polymer/eduke32/build/src/engine.c +++ b/polymer/eduke32/build/src/engine.c @@ -6408,6 +6408,12 @@ draw_as_face_sprite: // to the right of the player. Slowly rotate right toward it. When it // just becomes visible, the condition rx == xdim can occur. + // Don't pointlessly keep going. If the following condition holds, the + // ceilspritescan() at the end of our block would not draw any lines, + // and moreover may access uwall[] OOB (with x1==xdim). + if (rx-1 < lx) + return; + for (x=lx; x<=rx; x++) { uwall[x] = max(uwall[x],startumost[x+windowx1]-windowy1);