Only allow model meshes to have SHADER_MAX_VERTEXES - 1 vertexes

The last index is used to check for buffer overflows. See RB_CheckOverflow and RB_EndSurface.

4 files changed, 32 insertions, 32 deletions

diff --git a/src/renderergl1/tr_model.c b/src/renderergl1/tr_model.c
index 5ca53031..2a677be7 100644
--- a/src/renderergl1/tr_model.c
+++ b/src/renderergl1/tr_model.c
@@ -459,15 +459,15 @@ static qboolean R_LoadMD3 (model_t *mod, int lod, void *buffer, const char *mod_
         LL(surf->ofsXyzNormals);
         LL(surf->ofsEnd);
 		
-		if ( surf->numVerts > SHADER_MAX_VERTEXES ) {
+		if ( surf->numVerts >= SHADER_MAX_VERTEXES ) {
 			ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n",
-				mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface",
+				mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface",
 				surf->numVerts );
 			return qfalse;
 		}
-		if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) {
+		if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) {
 			ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n",
-				mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface",
+				mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface",
 				surf->numTriangles );
 			return qfalse;
 		}
@@ -737,17 +737,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char
 			// numBoneReferences and BoneReferences generally seem to be unused
 			
 			// now do the checks that may fail.
-			if ( surf->numVerts > SHADER_MAX_VERTEXES ) 
+			if ( surf->numVerts >= SHADER_MAX_VERTEXES ) 
 			{
 				ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n",
-					  mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface",
+					  mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface",
 					  surf->numVerts );
 				return qfalse;
 			}
-			if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) 
+			if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) 
 			{
 				ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n",
-					  mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface",
+					  mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface",
 					  surf->numTriangles );
 				return qfalse;
 			}
@@ -954,15 +954,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) {
 			LL(surf->ofsVerts);
 			LL(surf->ofsEnd);
 			
-			if ( surf->numVerts > SHADER_MAX_VERTEXES ) {
+			if ( surf->numVerts >= SHADER_MAX_VERTEXES ) {
 				ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n",
-					mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface",
+					mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface",
 					surf->numVerts );
 				return qfalse;
 			}
-			if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) {
+			if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) {
 				ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n",
-					mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface",
+					mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface",
 					surf->numTriangles );
 				return qfalse;
 			}
diff --git a/src/renderergl1/tr_model_iqm.c b/src/renderergl1/tr_model_iqm.c
index 9b7ff7f6..1116d09c 100644
--- a/src/renderergl1/tr_model_iqm.c
+++ b/src/renderergl1/tr_model_iqm.c
@@ -319,17 +319,17 @@ qboolean R_LoadIQM( model_t *mod, void *buffer, int filesize, const char *mod_na
 		}
 
 		// check ioq3 limits
-		if ( mesh->num_vertexes > SHADER_MAX_VERTEXES ) 
+		if ( mesh->num_vertexes >= SHADER_MAX_VERTEXES ) 
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i verts on %s (%i).\n",
-				  mod_name, SHADER_MAX_VERTEXES, meshName[0] ? meshName : "a surface",
+				  mod_name, SHADER_MAX_VERTEXES - 1, meshName[0] ? meshName : "a surface",
 				  mesh->num_vertexes );
 			return qfalse;
 		}
-		if ( mesh->num_triangles*3 > SHADER_MAX_INDEXES ) 
+		if ( mesh->num_triangles*3 >= SHADER_MAX_INDEXES ) 
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i triangles on %s (%i).\n",
-				  mod_name, SHADER_MAX_INDEXES / 3, meshName[0] ? meshName : "a surface",
+				  mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, meshName[0] ? meshName : "a surface",
 				  mesh->num_triangles );
 			return qfalse;
 		}
diff --git a/src/renderergl2/tr_model.c b/src/renderergl2/tr_model.c
index 54d42a38..f0bf8b31 100644
--- a/src/renderergl2/tr_model.c
+++ b/src/renderergl2/tr_model.c
@@ -496,17 +496,17 @@ static qboolean R_LoadMD3(model_t * mod, int lod, void *buffer, int bufferSize,
 		LL(md3Surf->ofsXyzNormals);
 		LL(md3Surf->ofsEnd);
 
-		if(md3Surf->numVerts > SHADER_MAX_VERTEXES)
+		if(md3Surf->numVerts >= SHADER_MAX_VERTEXES)
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n",
-				modName, SHADER_MAX_VERTEXES, md3Surf->name[0] ? md3Surf->name : "a surface",
+				modName, SHADER_MAX_VERTEXES - 1, md3Surf->name[0] ? md3Surf->name : "a surface",
 				md3Surf->numVerts );
 			return qfalse;
 		}
-		if(md3Surf->numTriangles * 3 > SHADER_MAX_INDEXES)
+		if(md3Surf->numTriangles * 3 >= SHADER_MAX_INDEXES)
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n",
-				modName, SHADER_MAX_INDEXES / 3, md3Surf->name[0] ? md3Surf->name : "a surface",
+				modName, ( SHADER_MAX_INDEXES / 3 ) - 1, md3Surf->name[0] ? md3Surf->name : "a surface",
 				md3Surf->numTriangles );
 			return qfalse;
 		}
@@ -997,17 +997,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char
 			// numBoneReferences and BoneReferences generally seem to be unused
 			
 			// now do the checks that may fail.
-			if ( surf->numVerts > SHADER_MAX_VERTEXES ) 
+			if ( surf->numVerts >= SHADER_MAX_VERTEXES ) 
 			{
 				ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n",
-					  mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface",
+					  mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface",
 					  surf->numVerts );
 				return qfalse;
 			}
-			if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) 
+			if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) 
 			{
 				ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n",
-					  mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface",
+					  mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface",
 					  surf->numTriangles );
 				return qfalse;
 			}
@@ -1214,15 +1214,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) {
 			LL(surf->ofsVerts);
 			LL(surf->ofsEnd);
 			
-			if ( surf->numVerts > SHADER_MAX_VERTEXES ) {
+			if ( surf->numVerts >= SHADER_MAX_VERTEXES ) {
 				ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n",
-					mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface",
+					mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface",
 					surf->numVerts );
 				return qfalse;
 			}
-			if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) {
+			if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) {
 				ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n",
-					mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface",
+					mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface",
 					surf->numTriangles );
 				return qfalse;
 			}
diff --git a/src/renderergl2/tr_model_iqm.c b/src/renderergl2/tr_model_iqm.c
index e949fb10..b76c30b4 100644
--- a/src/renderergl2/tr_model_iqm.c
+++ b/src/renderergl2/tr_model_iqm.c
@@ -318,17 +318,17 @@ qboolean R_LoadIQM( model_t *mod, void *buffer, int filesize, const char *mod_na
 		}
 
 		// check ioq3 limits
-		if ( mesh->num_vertexes > SHADER_MAX_VERTEXES ) 
+		if ( mesh->num_vertexes >= SHADER_MAX_VERTEXES ) 
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i verts on %s (%i).\n",
-				  mod_name, SHADER_MAX_VERTEXES, meshName[0] ? meshName : "a surface",
+				  mod_name, SHADER_MAX_VERTEXES - 1, meshName[0] ? meshName : "a surface",
 				  mesh->num_vertexes );
 			return qfalse;
 		}
-		if ( mesh->num_triangles*3 > SHADER_MAX_INDEXES ) 
+		if ( mesh->num_triangles*3 >= SHADER_MAX_INDEXES ) 
 		{
 			ri.Printf(PRINT_WARNING, "R_LoadIQM: %s has more than %i triangles on %s (%i).\n",
-				  mod_name, SHADER_MAX_INDEXES / 3, meshName[0] ? meshName : "a surface",
+				  mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, meshName[0] ? meshName : "a surface",
 				  mesh->num_triangles );
 			return qfalse;
 		}