From 20bf310cba643859ad30aa43ca0fe25fd39ff5ad Mon Sep 17 00:00:00 2001
From: hendricks266 <hendricks266@1a8010ca-5511-0410-912e-c29ae57300e0>
Date: Sat, 17 May 2014 12:36:03 +0000
Subject: [PATCH] Fix two Polymer crashes related to corrupted maps.

git-svn-id: https://svn.eduke32.com/eduke32@4471 1a8010ca-5511-0410-912e-c29ae57300e0
---
 polymer/eduke32/build/src/polymer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/polymer/eduke32/build/src/polymer.c b/polymer/eduke32/build/src/polymer.c
index 94ab87c49..078c6049f 100644
--- a/polymer/eduke32/build/src/polymer.c
+++ b/polymer/eduke32/build/src/polymer.c
@@ -2884,7 +2884,7 @@ static void         polymer_updatewall(int16_t wallnum)
     w = prwalls[wallnum];
     s = prsectors[sectofwall];
     invalid = s->invalidid;
-    if (nwallnum >= 0 && nwallnum < numwalls)
+    if (nwallnum >= 0 && nwallnum < numwalls && wal->nextsector >= 0 && wal->nextsector < numsectors)
     {
         ns = prsectors[wal->nextsector];
         invalid += ns->invalidid;
@@ -2969,7 +2969,7 @@ static void         polymer_updatewall(int16_t wallnum)
     else
         xref = 0;
 
-    if (wal->nextsector < 0 || wal->nextsector >= numsectors)
+    if (wal->nextsector < 0 || wal->nextsector >= numsectors || !ns)
     {
         Bmemcpy(w->wall.buffer, &s->floor.buffer[(wallnum - sec->wallptr) * 5], sizeof(GLfloat) * 3);
         Bmemcpy(&w->wall.buffer[5], &s->floor.buffer[(wal->point2 - sec->wallptr) * 5], sizeof(GLfloat) * 3);