From 27ddba9c2efead68c552c49d4417901b43175cda Mon Sep 17 00:00:00 2001 From: Zack Middleton Date: Wed, 4 Sep 2013 20:36:45 -0500 Subject: [PATCH] Fix crash caused by too many surfaces in skin --- code/renderergl1/tr_image.c | 5 +++++ code/renderergl2/tr_image.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/code/renderergl1/tr_image.c b/code/renderergl1/tr_image.c index 14cf9890..921bf7d0 100644 --- a/code/renderergl1/tr_image.c +++ b/code/renderergl1/tr_image.c @@ -1602,6 +1602,11 @@ qhandle_t RE_RegisterSkin( const char *name ) { // parse the shader name token = CommaParse( &text_p ); + if ( skin->numSurfaces >= MD3_MAX_SURFACES ) { + ri.Printf( PRINT_WARNING, "WARNING: Ignoring surfaces in '%s', the max is %d surfaces!\n", name, MD3_MAX_SURFACES ); + break; + } + surf = skin->surfaces[ skin->numSurfaces ] = ri.Hunk_Alloc( sizeof( *skin->surfaces[0] ), h_low ); Q_strncpyz( surf->name, surfName, sizeof( surf->name ) ); surf->shader = R_FindShader( token, LIGHTMAP_NONE, qtrue ); diff --git a/code/renderergl2/tr_image.c b/code/renderergl2/tr_image.c index c9ca6ce6..4eeeab8d 100644 --- a/code/renderergl2/tr_image.c +++ b/code/renderergl2/tr_image.c @@ -3284,6 +3284,11 @@ qhandle_t RE_RegisterSkin( const char *name ) { // parse the shader name token = CommaParse( &text_p ); + if ( skin->numSurfaces >= MD3_MAX_SURFACES ) { + ri.Printf( PRINT_WARNING, "WARNING: Ignoring surfaces in '%s', the max is %d surfaces!\n", name, MD3_MAX_SURFACES ); + break; + } + surf = skin->surfaces[ skin->numSurfaces ] = ri.Hunk_Alloc( sizeof( *skin->surfaces[0] ), h_low ); Q_strncpyz( surf->name, surfName, sizeof( surf->name ) ); surf->shader = R_FindShader( token, LIGHTMAP_NONE, qtrue );