From a23d2ae656432547c0ebb9b7eff5633f40e97246 Mon Sep 17 00:00:00 2001 From: Christoph Oelckers Date: Sun, 12 Dec 2021 15:52:40 +0100 Subject: [PATCH] - fixed OOB access in pushmove. The backwards search loop starts at one element behind the data it is supposed to check. If this is the last wall in the map it accesses undefined memory. This tripped the range check in TArray for wall[]. --- source/build/src/clip.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/build/src/clip.cpp b/source/build/src/clip.cpp index e07cecaea..d89fa0108 100644 --- a/source/build/src/clip.cpp +++ b/source/build/src/clip.cpp @@ -868,7 +868,7 @@ int pushmove_(vec3_t *const vect, int *const sectnum, if (dir > 0) startwall = sec->wallptr, endwall = startwall + sec->wallnum; else - endwall = sec->wallptr, startwall = endwall + sec->wallnum; + endwall = sec->wallptr - 1, startwall = endwall + sec->wallnum - 1; int i;