From fd3ec5682714cde7d38f30fff80f0db294697678 Mon Sep 17 00:00:00 2001 From: hendricks266 Date: Tue, 26 Nov 2019 08:24:23 +0000 Subject: [PATCH] SW: Fix OOB access when viewing a mirror git-svn-id: https://svn.eduke32.com/eduke32@8299 1a8010ca-5511-0410-912e-c29ae57300e0 --- source/sw/src/jsector.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/sw/src/jsector.cpp b/source/sw/src/jsector.cpp index 8509d3ee0..97f4464f1 100644 --- a/source/sw/src/jsector.cpp +++ b/source/sw/src/jsector.cpp @@ -578,7 +578,7 @@ JS_DrawMirrors(PLAYERp pp, int tx, int ty, int tz, short tpang, int tphoriz) { for (cnt = MAXMIRRORS - 1; cnt >= 0; cnt--) //if (TEST_GOTPIC(cnt + MIRRORLABEL) || TEST_GOTPIC(cnt + CAMSPRITE)) - if (TEST_GOTPIC(cnt + MIRRORLABEL) || TEST_GOTPIC(mirror[cnt].campic)) + if (TEST_GOTPIC(cnt + MIRRORLABEL) || ((unsigned)mirror[cnt].campic < MAXTILES && TEST_GOTPIC(mirror[cnt].campic))) { bIsWallMirror = FALSE; if (TEST_GOTPIC(cnt + MIRRORLABEL)) @@ -587,7 +587,7 @@ JS_DrawMirrors(PLAYERp pp, int tx, int ty, int tz, short tpang, int tphoriz) RESET_GOTPIC(cnt + MIRRORLABEL); } //else if (TEST_GOTPIC(cnt + CAMSPRITE)) - else if (TEST_GOTPIC(mirror[cnt].campic)) + else if ((unsigned)mirror[cnt].campic < MAXTILES && TEST_GOTPIC(mirror[cnt].campic)) { //RESET_GOTPIC(cnt + CAMSPRITE); RESET_GOTPIC(mirror[cnt].campic);