[iortcw] 28/497: All: Check for buffer overflow for rail/lightning surfaces

[Simon McVittie]

This is an automated email from the git hooks/post-receive script.

smcv pushed a commit to annotated tag 1.42d
in repository iortcw.

commit 03cb2908140e8ab6e98dc65b40ae77edbbcf0e13
Author: M4N4T4RMS at gmail.com <M4N4T4RMS at gmail.com@e65d2741-a53d-b2dc-ae96-bb75fa5e4c4a>
Date:   Sun Jan 26 04:08:03 2014 +0000

    All: Check for buffer overflow for rail/lightning surfaces
---
 MP/code/rend2/tr_surface.c    | 2 ++
 MP/code/renderer/tr_surface.c | 2 ++
 SP/code/rend2/tr_surface.c    | 2 ++
 SP/code/renderer/tr_surface.c | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/MP/code/rend2/tr_surface.c b/MP/code/rend2/tr_surface.c
index b0cf496..a6c6eed 100644
--- a/MP/code/rend2/tr_surface.c
+++ b/MP/code/rend2/tr_surface.c
@@ -753,6 +753,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int vbase;
 	float t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;
diff --git a/MP/code/renderer/tr_surface.c b/MP/code/renderer/tr_surface.c
index a40a110..d52a41b 100644
--- a/MP/code/renderer/tr_surface.c
+++ b/MP/code/renderer/tr_surface.c
@@ -482,6 +482,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int vbase;
 	float t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;
diff --git a/SP/code/rend2/tr_surface.c b/SP/code/rend2/tr_surface.c
index 66959fb..b248b8c 100644
--- a/SP/code/rend2/tr_surface.c
+++ b/SP/code/rend2/tr_surface.c
@@ -751,6 +751,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int vbase;
 	float t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;
diff --git a/SP/code/renderer/tr_surface.c b/SP/code/renderer/tr_surface.c
index 6d55703..b5f4b5c 100644
--- a/SP/code/renderer/tr_surface.c
+++ b/SP/code/renderer/tr_surface.c
@@ -482,6 +482,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int vbase;
 	float t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-games/iortcw.git