From 7e0a1709de58ea290a6edef7d7f2b4ec28427ac8 Mon Sep 17 00:00:00 2001 From: Jaime Ita Passos Date: Mon, 14 Dec 2020 00:53:42 -0300 Subject: [PATCH] Fix a crash in Picture_GetPatchPixel with PICFMT_DOOMPATCH formats --- src/r_picformats.c | 9 +++++---- src/r_textures.c | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/src/r_picformats.c b/src/r_picformats.c index 02f1de4ab..f87362c76 100644 --- a/src/r_picformats.c +++ b/src/r_picformats.c @@ -544,21 +544,22 @@ void *Picture_GetPatchPixel( UINT16 *s16 = NULL; UINT32 *s32 = NULL; softwarepatch_t *doompatch = (softwarepatch_t *)patch; + boolean isdoompatch = Picture_IsDoomPatchFormat(informat); INT16 width; if (patch == NULL) I_Error("Picture_GetPatchPixel: patch == NULL"); - width = (Picture_IsDoomPatchFormat(informat) ? patch->width : SHORT(patch->width)); + width = (isdoompatch ? SHORT(doompatch->width) : patch->width); if (x >= 0 && x < width) { INT32 colx = (flags & PICFLAGS_XFLIP) ? (width-1)-x : x; INT32 topdelta, prevdelta = -1; - INT32 colofs = (Picture_IsDoomPatchFormat(informat) ? LONG(patch->columnofs[colx]) : patch->columnofs[colx]); + INT32 colofs = (isdoompatch ? LONG(doompatch->columnofs[colx]) : patch->columnofs[colx]); - // Column offsets are pointers so no casting required - if (Picture_IsDoomPatchFormat(informat)) + // Column offsets are pointers, so no casting is required. + if (isdoompatch) column = (column_t *)((UINT8 *)doompatch + colofs); else column = (column_t *)((UINT8 *)patch->columns + colofs); diff --git a/src/r_textures.c b/src/r_textures.c index 9de9649e2..a006d739f 100644 --- a/src/r_textures.c +++ b/src/r_textures.c @@ -604,7 +604,7 @@ void *R_GetLevelFlat(levelflat_t *levelflat) levelflat->height = ds_flatheight = SHORT(patch->height); levelflat->picture = Z_Malloc(levelflat->width * levelflat->height, PU_LEVEL, NULL); - converted = Picture_FlatConvert(PICFMT_DOOMPATCH, patch, PICFMT_FLAT, 0, &size, levelflat->width, levelflat->height, patch->topoffset, patch->leftoffset, 0); + converted = Picture_FlatConvert(PICFMT_DOOMPATCH, patch, PICFMT_FLAT, 0, &size, levelflat->width, levelflat->height, SHORT(patch->topoffset), SHORT(patch->leftoffset), 0); M_Memcpy(levelflat->picture, converted, size); Z_Free(converted); }