diff options
| author | Zack Middleton <zturtleman@gmail.com> | 2013-06-18 17:02:47 -0500 |
|---|---|---|
| committer | Tim Angus <tim@ngus.net> | 2014-06-17 17:43:32 +0100 |
| commit | 2b6fe326bef2f881a453edfc0909a1af104ffd9d (patch) | |
| tree | 1f4adf62dab791da9475c839dab921497786471e /src/renderergl1/tr_model.c | |
| parent | d86e37ffe4011a77eacb38eb58e597afe151792e (diff) | |
Only allow model meshes to have SHADER_MAX_VERTEXES - 1 vertexes
The last index is used to check for buffer overflows. See RB_CheckOverflow and RB_EndSurface.
Diffstat (limited to 'src/renderergl1/tr_model.c')
| -rw-r--r-- | src/renderergl1/tr_model.c | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/src/renderergl1/tr_model.c b/src/renderergl1/tr_model.c index 5ca53031..2a677be7 100644 --- a/src/renderergl1/tr_model.c +++ b/src/renderergl1/tr_model.c @@ -459,15 +459,15 @@ static qboolean R_LoadMD3 (model_t *mod, int lod, void *buffer, const char *mod_ LL(surf->ofsXyzNormals); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -737,17 +737,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char // numBoneReferences and BoneReferences generally seem to be unused // now do the checks that may fail. - if ( surf->numVerts > SHADER_MAX_VERTEXES ) + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -954,15 +954,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) { LL(surf->ofsVerts); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } |