P_UnsetThingPosition : fix potential buffer overflow if the map objec…

…t is out of bounds
BodbDearg · Jan 9, 2020 · 8e3956e · 8e3956e
1 parent 888c296
commit 8e3956e
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/game/Doom/Game/p_maputl.cpp b/game/Doom/Game/p_maputl.cpp
@@ -225,7 +225,17 @@ void P_UnsetThingPosition(mobj_t& thing) noexcept {
         } else {
             const int32_t blockx = (thing.x - *gBlockmapOriginX) >> MAPBLOCKSHIFT;
             const int32_t blocky = (thing.y - *gBlockmapOriginY) >> MAPBLOCKSHIFT;
-            (*gppBlockLinks)[blocky * (*gBlockmapWidth) + blockx] = thing.next;
+
+            // PC-PSX: prevent buffer overflow if the map object is out of bounds
+            #if PC_PSX_DOOM_MODS
+                if (blockx >= 0 && blockx < *gBlockmapWidth) {
+                    if (blocky >= 0 && blocky < *gBlockmapHeight) {
+                        (*gppBlockLinks)[blocky * (*gBlockmapWidth) + blockx] = thing.next;
+                    }
+                }
+            #else
+                (*gppBlockLinks)[blocky * (*gBlockmapWidth) + blockx] = thing.next;
+            #endif
         }
     }
 }