From f245318b33c0b8398fbff96956a06d1098d46f83 Mon Sep 17 00:00:00 2001
From: Zack Middleton <zturtleman@gmail.com>
Date: Tue, 18 Jun 2013 18:00:45 -0500
Subject: Fix IQM tess buffer overflow

Set the variables that use tess.numVertexes after calling RB_CHECKOVERFLOW() as it may set tess.numVertexes to 0!

Could cause visual issues and error "RB_EndSurface() - SHADER_MAX_VERTEXES hit".
---
 src/renderergl1/tr_model_iqm.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'src/renderergl1')

diff --git a/src/renderergl1/tr_model_iqm.c b/src/renderergl1/tr_model_iqm.c
index 1116d09c..4859db4b 100644
--- a/src/renderergl1/tr_model_iqm.c
+++ b/src/renderergl1/tr_model_iqm.c
@@ -954,10 +954,10 @@ void RB_IQMSurfaceAnim( surfaceType_t *surface ) {
 	float		jointMats[IQM_MAX_JOINTS * 12];
 	int		i;
 
-	vec4_t		*outXYZ = &tess.xyz[tess.numVertexes];
-	vec4_t		*outNormal = &tess.normal[tess.numVertexes];
-	vec2_t		(*outTexCoord)[2] = &tess.texCoords[tess.numVertexes];
-	color4ub_t	*outColor = &tess.vertexColors[tess.numVertexes];
+	vec4_t		*outXYZ;
+	vec4_t		*outNormal;
+	vec2_t		(*outTexCoord)[2];
+	color4ub_t	*outColor;
 
 	int	frame = data->num_frames ? backEnd.currentEntity->e.frame % data->num_frames : 0;
 	int	oldframe = data->num_frames ? backEnd.currentEntity->e.oldframe % data->num_frames : 0;
@@ -969,6 +969,11 @@ void RB_IQMSurfaceAnim( surfaceType_t *surface ) {
 
 	RB_CHECKOVERFLOW( surf->num_vertexes, surf->num_triangles * 3 );
 
+	outXYZ = &tess.xyz[tess.numVertexes];
+	outNormal = &tess.normal[tess.numVertexes];
+	outTexCoord = &tess.texCoords[tess.numVertexes];
+	outColor = &tess.vertexColors[tess.numVertexes];
+
 	// compute interpolated joint matrices
 	if ( data->num_joints > 0 ) {
 		ComputePoseMats( data, frame, oldframe, backlerp, jointMats );
-- 
cgit