From ea3939f5a0e08267b482def6d49e4c438f7c4663 Mon Sep 17 00:00:00 2001
From: Ben Millwood <thebenmachine@gmail.com>
Date: Sat, 3 Oct 2009 13:12:36 +0000
Subject: * Fix bounds checks on cg.weaponSelect (/dev/humancontroller, bug
 #4267)

---
 src/cgame/cg_tutorial.c |  4 ++--
 src/cgame/cg_weapons.c  | 30 ++++++++++++++++++------------
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/cgame/cg_tutorial.c b/src/cgame/cg_tutorial.c
index 41507162..8db27d23 100644
--- a/src/cgame/cg_tutorial.c
+++ b/src/cgame/cg_tutorial.c
@@ -409,9 +409,9 @@ static void CG_HumanText( char *text, playerState_t *ps )
   char      *name;
   upgrade_t upgrade = UP_NONE;
 
-  if( cg.weaponSelect <= 32 )
+  if( cg.weaponSelect < 32 )
     name = cg_weapons[ cg.weaponSelect ].humanName;
-  else if( cg.weaponSelect > 32 )
+  else
   {
     name = cg_upgrades[ cg.weaponSelect - 32 ].humanName;
     upgrade = cg.weaponSelect - 32;
diff --git a/src/cgame/cg_weapons.c b/src/cgame/cg_weapons.c
index b6b2b3a3..803a866a 100644
--- a/src/cgame/cg_weapons.c
+++ b/src/cgame/cg_weapons.c
@@ -1391,10 +1391,16 @@ void CG_DrawItemSelect( rectDef_t *rect, vec4_t color )
   if( !( cg.snap->ps.pm_flags & PMF_FOLLOW ) )
   {
     // first make sure that whatever it selected is actually selectable
-    if( cg.weaponSelect <= 32 && !CG_WeaponSelectable( cg.weaponSelect ) )
-      CG_NextWeapon_f( );
-    else if( cg.weaponSelect > 32 && !CG_UpgradeSelectable( cg.weaponSelect - 32 ) )
-      CG_NextWeapon_f( );
+    if( cg.weaponSelect < 32 )
+    {
+      if( !CG_WeaponSelectable( cg.weaponSelect ) )
+        CG_NextWeapon_f( );
+    }
+    else
+    {
+      if( !CG_UpgradeSelectable( cg.weaponSelect - 32 ) )
+        CG_NextWeapon_f( );
+    }
   }
 
   // showing weapon select clears pickup item display, but not the blend blob
@@ -1477,10 +1483,10 @@ void CG_DrawItemSelect( rectDef_t *rect, vec4_t color )
       color[3] = 0.5;
       trap_R_SetColor( color );
 
-      if( items[ item ] <= 32 )
+      if( items[ item ] < 32 )
         CG_DrawPic( x, y, iconWidth, iconHeight,
                     cg_weapons[ items[ item ] ].weaponIcon );
-      else if( items[ item ] > 32 )
+      else
         CG_DrawPic( x, y, iconWidth, iconHeight,
                     cg_upgrades[ items[ item ] - 32 ].upgradeIcon );
     }
@@ -1511,7 +1517,7 @@ void CG_DrawItemSelectText( rectDef_t *rect, float scale, int textStyle )
   trap_R_SetColor( color );
 
   // draw the selected name
-  if( cg.weaponSelect <= 32 )
+  if( cg.weaponSelect < 32 )
   {
     if( cg_weapons[ cg.weaponSelect ].registered &&
         BG_InventoryContainsWeapon( cg.weaponSelect, cg.snap->ps.stats ) )
@@ -1524,7 +1530,7 @@ void CG_DrawItemSelectText( rectDef_t *rect, float scale, int textStyle )
       }
     }
   }
-  else if( cg.weaponSelect > 32 )
+  else
   {
     if( cg_upgrades[ cg.weaponSelect - 32 ].registered &&
         BG_InventoryContainsUpgrade( cg.weaponSelect - 32, cg.snap->ps.stats ) )
@@ -1570,12 +1576,12 @@ void CG_NextWeapon_f( void )
     if( cg.weaponSelect == 64 )
       cg.weaponSelect = 0;
 
-    if( cg.weaponSelect <= 32 )
+    if( cg.weaponSelect < 32 )
     {
       if( CG_WeaponSelectable( cg.weaponSelect ) )
         break;
     }
-    else if( cg.weaponSelect > 32 )
+    else
     {
       if( CG_UpgradeSelectable( cg.weaponSelect - 32 ) )
         break;
@@ -1614,12 +1620,12 @@ void CG_PrevWeapon_f( void )
     if( cg.weaponSelect == -1 )
       cg.weaponSelect = 63;
 
-    if( cg.weaponSelect <= 32 )
+    if( cg.weaponSelect < 32 )
     {
       if( CG_WeaponSelectable( cg.weaponSelect ) )
         break;
     }
-    else if( cg.weaponSelect > 32 )
+    else
     {
       if( CG_UpgradeSelectable( cg.weaponSelect - 32 ) )
         break;
-- 
cgit