search

ec- / Quake3e

Improved Quake III Arena engine
GNU General Public License v2.0
1.21k stars 154 forks source link

Potential crash in FixRenderCommandList #208

Closed Chomenor closed 1 year ago

Chomenor commented 1 year ago

The function FixRenderCommandList is called before the command list has been terminated with RC_END_OF_LIST, causing commands to be read from uninitialized memory at the end of iteration.

Usually this has no effect because the command id doesn't match any valid command and the iteration is aborted. However in some cases, especially if the command id from uninitialized memory happens to land on 3 (RC_DRAW_SURFS), this could lead to a crash.

ec- commented 1 year ago

@Chomenor, thank you for report, fixed in https://github.com/ec-/Quake3e/commit/d2d1dc4d715da5c609bf2c643fce4a0579cc9dec

Chomenor commented 1 year ago

Thanks! I notice this fix doesn't apply to the opengl2 renderer, but I assume that is intentional, so not a big deal.