From bdb083f457dacc07c7b02352f12d8163f006ed89 Mon Sep 17 00:00:00 2001
From: Marisa Kirisame <marisa@sayachan.org>
Date: Fri, 12 Jul 2019 15:40:29 +0200
Subject: [PATCH] Shape2D drawing will gracefully abort the VM on any out of
 bounds access.

---
 src/rendering/2d/v_2ddrawer.cpp | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/rendering/2d/v_2ddrawer.cpp b/src/rendering/2d/v_2ddrawer.cpp
index b1ecd9a51..2a0ced4bb 100644
--- a/src/rendering/2d/v_2ddrawer.cpp
+++ b/src/rendering/2d/v_2ddrawer.cpp
@@ -412,6 +412,10 @@ void F2DDrawer::AddTexture(FTexture *img, DrawParms &parms)
 
 void F2DDrawer::AddShape( FTexture *img, DShape2D *shape, DrawParms &parms )
 {
+	// [MK] bail out if vertex/coord array sizes are mismatched
+	if ( shape->mVertices.Size() != shape->mCoords.Size() )
+		ThrowAbortException(X_OTHER, "Mismatch in vertex/coord count: %u != %u", shape->mVertices.Size(), shape->mCoords.Size());
+
 	if (parms.style.BlendOp == STYLEOP_None) return;	// not supposed to be drawn.
 
 	PalEntry vertexcolor;
@@ -464,7 +468,17 @@ void F2DDrawer::AddShape( FTexture *img, DShape2D *shape, DrawParms &parms )
 	dg.mIndexIndex = mIndices.Size();
 	dg.mIndexCount += shape->mIndices.Size();
 	for ( int i=0; i<int(shape->mIndices.Size()); i+=3 )
+	{
+		// [MK] bail out if any indices are out of bounds
+		for ( int j=0; j<3; j++ )
+		{
+			if ( shape->mIndices[i+j] < 0 )
+				ThrowAbortException(X_ARRAY_OUT_OF_BOUNDS, "Triangle %u index %u is negative: %i\n", i/3, j, shape->mIndices[i+j]);
+			if ( shape->mIndices[i+j] >= dg.mVertCount )
+				ThrowAbortException(X_ARRAY_OUT_OF_BOUNDS, "Triangle %u index %u: %u, max: %u\n", i/3, j, shape->mIndices[i+j], dg.mVertCount-1);
+		}
 		AddIndices(dg.mVertIndex, 3, shape->mIndices[i], shape->mIndices[i+1], shape->mIndices[i+2]);
+	}
 	AddCommand(&dg);
 }