Check for buffer overflow for rail/lightning surfaces

ioquake · Jan 26, 2014 · cc9072d · cc9072d
1 parent dde36d9
commit cc9072d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/code/renderergl1/tr_surface.c b/code/renderergl1/tr_surface.c
@@ -344,6 +344,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int			vbase;
 	float		t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;

diff --git a/code/renderergl2/tr_surface.c b/code/renderergl2/tr_surface.c
@@ -627,6 +627,8 @@ static void DoRailCore( const vec3_t start, const vec3_t end, const vec3_t up, f
 	int			vbase;
 	float		t = len / 256.0f;
 
+	RB_CHECKOVERFLOW( 4, 6 );
+
 	vbase = tess.numVertexes;
 
 	spanWidth2 = -spanWidth;