From e0e3973b47a6cb5e66ad596723ebc4ca33467d25 Mon Sep 17 00:00:00 2001
From: helixhorned <helixhorned@1a8010ca-5511-0410-912e-c29ae57300e0>
Date: Fri, 23 Aug 2013 17:01:14 +0000
Subject: [PATCH] Bounds-check the tile number gotten from EVENT_GETMENUTILE.

git-svn-id: https://svn.eduke32.com/eduke32@4034 1a8010ca-5511-0410-912e-c29ae57300e0
---
 polymer/eduke32/source/game.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/polymer/eduke32/source/game.c b/polymer/eduke32/source/game.c
index 154014e38..b4c25b977 100644
--- a/polymer/eduke32/source/game.c
+++ b/polymer/eduke32/source/game.c
@@ -3952,9 +3952,10 @@ void G_DrawBackground(void)
         if (!fstilep)
 #endif
         {
-            for (y=y1; y<y2; y+=tilesizy[bgtile])
-                for (x=0; x<xdim; x+=tilesizx[bgtile])
-                    rotatesprite_fs(x<<16,y<<16,65536L,0,bgtile,16,0,8+16+64);
+            if ((unsigned)bgtile < MAXTILES)
+                for (y=y1; y<y2; y+=tilesizy[bgtile])
+                    for (x=0; x<xdim; x+=tilesizx[bgtile])
+                        rotatesprite_fs(x<<16,y<<16,65536L,0,bgtile,16,0,8+16+64);
         }
         else rotatesprite_fs(320<<15,200<<15,65536L,0,bgtile,16,0,2+8+64+(ud.bgstretch?1024:0));
         return;