From 2b6fe326bef2f881a453edfc0909a1af104ffd9d Mon Sep 17 00:00:00 2001 From: Zack Middleton Date: Tue, 18 Jun 2013 17:02:47 -0500 Subject: Only allow model meshes to have SHADER_MAX_VERTEXES - 1 vertexes The last index is used to check for buffer overflows. See RB_CheckOverflow and RB_EndSurface. --- src/renderergl1/tr_model.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) (limited to 'src/renderergl1/tr_model.c') diff --git a/src/renderergl1/tr_model.c b/src/renderergl1/tr_model.c index 5ca53031..2a677be7 100644 --- a/src/renderergl1/tr_model.c +++ b/src/renderergl1/tr_model.c @@ -459,15 +459,15 @@ static qboolean R_LoadMD3 (model_t *mod, int lod, void *buffer, const char *mod_ LL(surf->ofsXyzNormals); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD3: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -737,17 +737,17 @@ static qboolean R_LoadMDR( model_t *mod, void *buffer, int filesize, const char // numBoneReferences and BoneReferences generally seem to be unused // now do the checks that may fail. - if ( surf->numVerts > SHADER_MAX_VERTEXES ) + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMDR: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } @@ -954,15 +954,15 @@ static qboolean R_LoadMD4( model_t *mod, void *buffer, const char *mod_name ) { LL(surf->ofsVerts); LL(surf->ofsEnd); - if ( surf->numVerts > SHADER_MAX_VERTEXES ) { + if ( surf->numVerts >= SHADER_MAX_VERTEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i verts on %s (%i).\n", - mod_name, SHADER_MAX_VERTEXES, surf->name[0] ? surf->name : "a surface", + mod_name, SHADER_MAX_VERTEXES - 1, surf->name[0] ? surf->name : "a surface", surf->numVerts ); return qfalse; } - if ( surf->numTriangles*3 > SHADER_MAX_INDEXES ) { + if ( surf->numTriangles*3 >= SHADER_MAX_INDEXES ) { ri.Printf(PRINT_WARNING, "R_LoadMD4: %s has more than %i triangles on %s (%i).\n", - mod_name, SHADER_MAX_INDEXES / 3, surf->name[0] ? surf->name : "a surface", + mod_name, ( SHADER_MAX_INDEXES / 3 ) - 1, surf->name[0] ? surf->name : "a surface", surf->numTriangles ); return qfalse; } -- cgit