Skip to content

Commit c9306b5

Browse files
committed
Fixing the code in the CalculeLigneOmbre that sometimes could save negative value in MinYTabPoint, which caused an out-of-bounds and memory corruption as the result
1 parent 4093cf6 commit c9306b5

1 file changed

Lines changed: 21 additions & 14 deletions

File tree

SOURCES/BEZIER.CPP

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@
1313

1414
#include "C_EXTERN.H"
1515

16+
#define MAX_SCAN_LINES 480
17+
1618
/*──────────────────────────────────────────────────────────────────────────*/
1719
//▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
18-
S32 TabCoorPoint[480][4];
19-
S32 TabNbPoint[480];
20+
S32 TabCoorPoint[MAX_SCAN_LINES][4];
21+
S32 TabNbPoint[MAX_SCAN_LINES];
2022
S32 MinYTabPoint,MaxYTabPoint;
2123

2224
S32 XS0,YS0,XS1,YS1,XS2,YS2,XS3,YS3 ;
@@ -55,22 +57,21 @@ void CalculeLigneOmbre( S32 x1, S32 y1, S32 x2, S32 y2 )
5557
}
5658

5759
if (y2>ClipYMax) y2=ClipYMax;
60+
x+=ix;
61+
y1++;
5862

5963
if (y1<MinYTabPoint) MinYTabPoint=y1;
60-
6164
if (y2>MaxYTabPoint) MaxYTabPoint=y2;
6265

63-
64-
x+=ix;
65-
y1++;
66-
67-
for( y=y1; y<=y2; y++ )
66+
for (y=y1; y<=y2; y++)
6867
{
69-
TabCoorPoint[y][TabNbPoint[y]++]=FTOW(x);
68+
if ((U32)y < MAX_SCAN_LINES AND (U32)TabNbPoint[y] < 4)
69+
{
70+
TabCoorPoint[y][TabNbPoint[y]++]=FTOW(x);
71+
}
7072
//Plot(FTOW(x),y,15);
7173
x+=ix;
7274
}
73-
7475
}
7576
}
7677

@@ -208,13 +209,19 @@ void DrawLineShade( S32 x0, S32 z0, S32 x1, S32 z1, S32 x2, S32 z2, S32 x3, S32
208209
{
209210
S32 y,j,k;
210211
S32 temp;
212+
S32 yStart, yEnd;
211213

212-
MinYTabPoint=ClipYMax;
213-
MaxYTabPoint=ClipYMin;
214-
214+
MinYTabPoint = ClipYMax;
215+
MaxYTabPoint = ClipYMin;
215216
DrawOmbre(x0,z0,x1,z1,x2,z2,x3,z3);
216217

217-
for ( y = MinYTabPoint; y <= MaxYTabPoint; y++ )
218+
yStart = MinYTabPoint;
219+
yEnd = MaxYTabPoint;
220+
221+
if (yStart < 0) yStart = 0;
222+
if (yEnd > MAX_SCAN_LINES - 1) yEnd = MAX_SCAN_LINES - 1;
223+
224+
for (y = yStart; y <= yEnd; y++)
218225
{
219226
switch( TabNbPoint[y] )
220227
{

0 commit comments

Comments
 (0)