From 15cbf4bae66359a3ffe9eb2b20b30ca31df39768 Mon Sep 17 00:00:00 2001 From: Christoph Oelckers Date: Tue, 4 Oct 2016 09:28:19 +0200 Subject: [PATCH 1/2] - fixed: DecoHandleRuntimeState must check all parent classes when trying to determine if the target is a valid state. It should also ensure that both the calling and target state belong to the same actor. Although unlikely it cannot be entirely ruled out that a bogus index randomly points to a seemingly valid state elsewhere. --- src/thingdef/thingdef_expression.cpp | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/thingdef/thingdef_expression.cpp b/src/thingdef/thingdef_expression.cpp index 700ac94bb..c2b2d25e6 100644 --- a/src/thingdef/thingdef_expression.cpp +++ b/src/thingdef/thingdef_expression.cpp @@ -4956,6 +4956,25 @@ FxExpression *FxRuntimeStateIndex::Resolve(FCompileContext &ctx) return this; } +static bool VerifyJumpTarget(AActor *stateowner, FStateParamInfo *stateinfo, int index) +{ + PClassActor *cls = stateowner->GetClass(); + + while (cls != RUNTIME_CLASS(AActor)) + { + // both calling and target state need to belong to the same class. + if (cls->OwnsState(stateinfo->mCallingState)) + { + return cls->OwnsState(stateinfo->mCallingState + index); + } + + // We can safely assume the ParentClass is of type PClassActor + // since we stop when we see the Actor base class. + cls = static_cast(cls->ParentClass); + } + return false; +} + static int DecoHandleRuntimeState(VMFrameStack *stack, VMValue *param, int numparam, VMReturn *ret, int numret) { PARAM_PROLOGUE; @@ -4963,7 +4982,7 @@ static int DecoHandleRuntimeState(VMFrameStack *stack, VMValue *param, int numpa PARAM_POINTER(stateinfo, FStateParamInfo); PARAM_INT(index); - if (index == 0 || !stateowner->GetClass()->OwnsState(stateinfo->mCallingState + index)) + if (index == 0 || !VerifyJumpTarget(stateowner, stateinfo, index)) { // Null is returned if the location was invalid which means that no jump will be performed // if used as return value From 0e9f808c8a3000b376aa607a987a8d96a969a45f Mon Sep 17 00:00:00 2001 From: Major Cooke Date: Tue, 4 Oct 2016 10:04:33 -0500 Subject: [PATCH 2/2] Fixed: FLATSPRITES were drawn backwards. --- src/gl/scene/gl_sprite.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/gl/scene/gl_sprite.cpp b/src/gl/scene/gl_sprite.cpp index ab88f2f9c..e9748fba6 100644 --- a/src/gl/scene/gl_sprite.cpp +++ b/src/gl/scene/gl_sprite.cpp @@ -138,10 +138,10 @@ void GLSprite::CalculateVertices(FVector3 *v) mat.Rotate(0, 1, 0, - actor->Angles.Roll.Degrees); mat.Translate(-x, -z, -y); } - v[0] = mat * FVector3(x1, z, y2); - v[1] = mat * FVector3(x2, z, y2); - v[2] = mat * FVector3(x1, z, y1); - v[3] = mat * FVector3(x2, z, y1); + v[0] = mat * FVector3(x2, z, y2); + v[1] = mat * FVector3(x1, z, y2); + v[2] = mat * FVector3(x2, z, y1); + v[3] = mat * FVector3(x1, z, y1); return; }